Strapi Admin Passkeys

Sign in to an existing Strapi administrator account with a passkey, alongside password login.

• Manage your own passkeys at /admin/settings/passkeys using Strapi’s native design system.
• Sign in without typing an email or password after enrolling a passkey.
• Automatic provider names when available; browser + version + registration IP otherwise. Rename or revoke anytime.

Need complete SSO? Use Strapi’s premium Single Sign-On. This plugin provides local passkey authentication, not identity-provider integration or account provisioning. Passkey enrollment and login are disabled when Strapi’s SSO feature is enabled.

Setup

Requires Strapi 5.56.0, Node.js 22+, and HTTPS in production. HTTP on localhost is supported for development.

Build this checkout, then add it to your Strapi project:

bun install
bun run build
# Run from your Strapi project:
bun add /absolute/path/to/strapi-plugin-admin-passkeys

Enable it in config/plugins.ts:

export default () => ({
  passkeys: {
    enabled: true,
    config: {
      rpName: 'My Strapi Admin',
      rpID: 'cms.example.com',
      origin: 'https://cms.example.com', // No path or trailing slash.
    },
  },
});

Strapi has no public login-button injection zone. Apply the explicit, idempotent patch from your Strapi project, then rebuild:

bun node_modules/strapi-plugin-admin-passkeys/scripts/patch-admin.mjs
bun run build

The patch only supports @strapi/admin 5.56.0 and must be reapplied after reinstalling dependencies. Password login stays unchanged. Sign in normally, open Settings → Passkeys, and confirm your current password to enroll.

Development

bun run check              # Types, unit tests, minified ESM/CJS build.
bunx playwright install chromium
bun run test:integration   # Real Strapi + WebAuthn virtual authenticator.
bun run build:fixture
bun run test:ui            # Native admin registration, login, rename, delete.

Provider detection is best-effort, not proof of a provider’s identity. Keep password recovery available. Registration IP may appear in fallback names; consider your privacy policy. Rate limits are per process, so multi-instance deployments also need gateway-level limits. Tested with SQLite and Chromium; verify real devices and your production database before rollout.