# Sign in to Pulumi Cloud with Passkeys

DevFeed: [Sign in to Pulumi Cloud with Passkeys](<https://devfeed.tech/articles/sign-in-to-pulumi-cloud-with-passkeys-19019.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/passkey-support-in-pulumi-cloud/>)

Author: Devon Grove

Published: 2026-07-13T00:00:00Z

Content type: release

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Passkeys](<https://devfeed.tech/topics/passkeys.md>), [WebAuthn](<https://devfeed.tech/topics/webauthn.md>), [Security](<https://devfeed.tech/topics/security.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [bitbucket](<https://devfeed.tech/tags/bitbucket.md>), [features](<https://devfeed.tech/tags/features.md>), [gitlab](<https://devfeed.tech/tags/gitlab.md>), [google](<https://devfeed.tech/tags/google.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [product](<https://devfeed.tech/tags/product.md>), [product-launches](<https://devfeed.tech/tags/product-launches.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Pulumi Cloud now supports passkeys for users who sign in with an email address and password. Passkeys use device-stored public-key credentials and WebAuthn, while identity-provider sign-in flows remain unchanged.

## Source excerpt

Pulumi Cloud now supports passkeys for users who sign in with email and password. Select a button, approve with Touch ID, Face ID, Windows Hello, or your hardware key, and you're signed in. A passkey is a public-key credential stored on your device: your phone, your laptop, a hardware key (YubiKey, Google Titan, etc.), or your password manager can all function as the authenticator. When you sign in, your device authenticates you locally and signs a challenge from Pulumi Cloud with the private key. The private key stays on your device -- Pulumi Cloud never sees or stores it. Passkeys are built on the WebAuthn standard, so they're already supported on every major browser and operating system. Who this is for This release applies to users who sign in to Pulumi Cloud with an email address and password. If you sign in through an identity provider (IdP), such as GitHub OAuth, GitLab, Bitbucket, Google, or your organization's SAML SSO, your existing flow is unchanged. Why passkeys Passwords have always been the weakest link in account security. Since they are shared secrets, they are vulnerable to phishing attacks, and every place you type one is a place that can be impersonated or a data store that can be leaked. Passkeys swap that out for a per-site key pair that lives on your device: Phishing-resistant by design. A passkey is bound to the exact origin it was registered for. A look-alike domain can't trigger your authenticator. Synced across your devices. Apple iCloud Keychain, Google Password Manager, 1Password, Dashlane, Bitwarden: most credential managers now sync passkeys end-to-end-encrypted to every device you've signed in on. Discoverable. Pulumi Cloud doesn't need to know which user you are before you authenticate. Just select "Sign in with a passkey" and your device offers the right credential. Nothing to remember. A passkey lives on your device. There's no string to memorize, and no sensitive credential stored by us. Setting up a passkey The next time you sign i