Passkeys Settings
Customize your WebAuthn authentication from the Descope console (Settings > Authentication Methods > Passkeys).
Enable Method in API and SDK
The Enable method in API and SDK toggle controls whether passkeys authentication can be invoked programmatically via APIs and SDKs.
- When enabled: Authentication works via flows, APIs, and SDKs
- When disabled: Authentication only works with flows or calls made with a valid management key
Available Settings
This section describes additional details about the configuration options available.
Display Name
The Display Name is the human-readable name shown to users when they create or use a passkey. By default, it uses your project name. You can set it to any text you want—for example, your product or company name.
Note
Whether users see the display name depends on their password manager. Some, such as Bitwarden, show it; others only show the top-level domain.
Top Level Domain
The configured domain defines where end users can set up biometric authentication. The top-level Biometrics (WebAuthn) domain restricts where users are allowed to authenticate, applying to both the domain itself and all its subdomains. By default, Descope automatically derives this top-level domain from the request origin.
Changing the top-level domain for Biometrics (WebAuthn) in the Descope UI can invalidate existing users if the new domain no longer matches the one they originally registered with. Users who rely solely on WebAuthn will be unable to log in and must be deleted and recreated. Users with other verified authentication methods can still sign in through those methods, though registering with WebAuthn again may create a new credential.
Android Fingerprints
Add the SHA-256 fingerprints of the Android keystores used to sign your Android APK, in colon-separated hex format.
Note
Find the Android keystore file used to sign your Android app and run this command: keytool -list -v -keystore my_keystore.jks