# Passkeys support in upcoming Keycloak release (26.4)

DevFeed: [Passkeys support in upcoming Keycloak release (26.4)](<https://devfeed.tech/articles/passkeys-support-in-upcoming-keycloak-release-26-4-31724.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2025/09/passkeys-support-26-4>)

Author: Peter Skopek

Published: 2025-09-16T00:00:00Z

Content type: release

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Passkeys](<https://devfeed.tech/topics/passkeys.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [WebAuthn](<https://devfeed.tech/topics/webauthn.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [keycloak-release](<https://devfeed.tech/tags/keycloak-release.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [password](<https://devfeed.tech/tags/password.md>), [release](<https://devfeed.tech/tags/release.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>)

## AI overview

Keycloak 26.4.0 is announced as adding official passkey support. The feature uses conditional and modal UI, is disabled by default, and can be enabled through the WebAuthn Passwordless Policy. A new conditional credential authenticator can skip 2FA when a passkey was used as the primary credential.

## Source excerpt

Passkeys have been available in Keycloak since version 23.0.0 as a preview feature. We are happy to announce official support for passkeys in upcoming Keycloak 26.4.0. What is passkey? Definition from FIDO Alliance A passkey is a FIDO authentication credential based on FIDO standards, that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern). Passkeys are FIDO cryptographic credentials that are tied to a user's account on a website or application. More info What's new? Passkeys are now seamlessly integrated to Keycloak using both conditional and modal UI. There is no need to modify default browser flow to use passkeys. Passkeys support is not enabled by default. It needs to be enabled in the WebAuthn Passwordless Policy (Authentication -> Policies -> Webauthn Passwordless Policy). There is new Conditional - credential authenticator that checks if a specific credential type (passkey) has been used during the authentication process. It is added to the default browser flow to skip 2FA in case a passkey was used to log in as the primary credential. Further quite hidden passkey support is also in the re-authentication form, where users can choose passkey as well as password. For more information check Keycloak Server Administration Guide. A few examples Let's start form the fresh Keycloak database. The first steps are obvious ones. create admin user create one test user enable passkey support in (Authentication -> Policies -> Webauthn Passwordless Policy) set default required action in (Authentication -> Required actions -> Webauthn Register Passwordless) (This step is not necessary, one can use Account Console to register a passkey.) No need for any other changes. Conditional UI Conditional UI is displayed when other components of the platform supports this UI style and username input field is present. It can be achieved for example on Linux using Google Chrome browser and 1password password man