# Passkeys as a second factor

Users can now use a passkey as their second factor for [multi-factor authentication](https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options.md#multi-factor-authentication) after they sign in another way. A passkey combines two factors, a device and a PIN or biometric, in one step.

When users sign in with a password, a social connection, or a reset-password code, they can use their passkey instead of an SMS code or authenticator app, including during [reverification](https://clerk.com/docs/guides/secure/reverification.md). In [`<SignIn />`](https://clerk.com/docs/reference/components/authentication/sign-in.md) and the reverification modal, users who have a passkey start on the passkey step and can pick another method with **Use another method**.

This also helps with recovery. A user who loses their phone or authenticator app can sign in with their password and use their passkey as their second factor, without waiting for an [MFA reset](https://clerk.com/docs/guides/secure/mfa-recovery.md).

A passkey doesn't turn on MFA for a user. Clerk doesn't prompt users who haven't set up MFA for a separate second factor. If you [require MFA](https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options.md#multi-factor-authentication), those users must set up a second factor before sign-in finishes, including when they sign in with a passkey.

## Get started

Native apps need clerk-ios 1.5.0, clerk-android 1.1.4, `@clerk/expo` 4.13.1, or later. Web apps need `@clerk/clerk-js` 6.40.0 and `@clerk/ui` 1.41.0 or later: upgrade your SDK to the minimum version in the [versioning guide](https://clerk.com/docs/guides/development/upgrading/versioning.md#2026-08-20), and if you pin either package or bundle `@clerk/ui`, upgrade it too.

Then:

1. If your application was created before July 8, 2026, turn on **Passkeys satisfy multi-factor authentication** under **Sign-in with passkey** on the [**User & authentication**](https://dashboard.clerk.com/~/user-authentication/user-and-authentication) page. Newer applications already have it on, and native apps offer the passkey second factor once it's on.
2. For web apps, opt in to the **Passkeys as a second factor on the web** update on the [**Updates**](https://dashboard.clerk.com/~/updates) page if your instance doesn't have it. Instances created on or after October 19, 2026 already have it, except production instances cloned from a development instance without it.

If you're building a custom flow, `supportedSecondFactors` can now include `passkey`. See the [custom MFA flow guide](https://clerk.com/docs/guides/development/custom-flows/authentication/multi-factor-authentication.md) to complete it, and the [passkeys and MFA guide](https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options.md#passkeys-and-multi-factor-authentication) for SDK requirements.