Passkeys Settings

Customize your WebAuthn authentication from the Descope console (Settings > Authentication Methods > Passkeys).

Enable Method in API and SDK

The Enable method in API and SDK toggle controls whether passkeys authentication can be invoked programmatically via APIs and SDKs.

• When enabled: Authentication works via flows, APIs, and SDKs
• When disabled: Authentication only works with flows or calls made with a valid management key

Available Settings

This section describes additional details about the configuration options available.

Top Level Domain

The configured domain defines where end users can set up biometric authentication. The top-level Biometrics (WebAuthn) domain restricts where users are allowed to authenticate, applying to both the domain itself and all its subdomains. By default, Descope automatically derives this top-level domain from the request origin.

Changing the top-level domain for Biometrics (WebAuthn) in the Descope UI can invalidate existing users if the new domain no longer matches the one they originally registered with. Users who rely solely on WebAuthn will be unable to log in and must be deleted and recreated. Users with other verified authentication methods can still sign in through those methods, though registering with WebAuthn again may create a new credential.