# Frappe Passkey: passwordless sign-in — Andrometiq

Phishing-resistant, passwordless sign-in for Frappe and ERPNext. Use a fingerprint, face or screen lock. Free and open source under the MIT licence.

Canonical: https://andrometiq.com/software/passkey/

[Home](/) › [Software](/software/) › Frappe Passkey

Software · Open source

# Frappe Passkey

Phishing-resistant, passwordless sign-in for Frappe and ERPNext. Your users sign in with the fingerprint, face or screen lock they already use. Free and open source under the MIT licence.

[Read why passkeys are safer](/software/passkey/why-passkeys-are-safer/)

[Start a conversation](/contact/)

Key features

## What Frappe Passkey does.

### Sign in without a password

Choose a passkey in the username field, use the “Sign in with a passkey” button, or scan a QR code with your phone to sign in on another device. The autofill option is called conditional UI.

### Add a second factor

Keep the password and ask for a passkey after it. This uses Frappe’s own two-factor flow. A one-time code remains an option only if the site allows that fallback.

### Confirm sensitive actions

Ask for a fresh passkey confirmation before an action such as releasing a bank payment. Developers add @passkey_protected to a whitelisted method. By default, the confirmation is single-use, expires in about three minutes, and is bound to the user, session, action and the argument values named in bind_params. Arguments left out are not bound.

### Help people enrol

Nudge users with a prompt cap and cooldown, or require enrollment for selected roles or everyone, with grace sign-ins. System Managers can stay required separately. Phone and QR enrollment is offered. The enrollment prompt runs after sign-in; the login modes decide how a session is authenticated.

### Let users manage their passkeys

Users add, rename and remove their own passkeys at /passkeys. They can turn on “Passwordless login only” for their account after adding at least two enabled passkeys.

### See the remaining ways in

The security-posture panel in Passkey Settings lists sign-in routes that do not need a passkey and how to close them. System Managers can exempt a user from enrollment or reset their grace sign-ins on the User form. Recovery procedures cover lost passkeys and an administrator who cannot sign in.

Screens

## What your users and admins see.

*The Frappe login page with a Sign in with a passkey button.*

![Frappe login form with the Sign in with a passkey button above Login.](/assets/images/passkey/login.036d5191.png)

*My Passkeys — self-service management at /passkeys, with a switch for passwordless-only login.*

![My Passkeys with saved MacBook Pro and Pixel passkeys, rename and remove controls, Add a passkey, and Passwordless login only.](/assets/images/passkey/portal.2ab84350.png)

*Passkey Settings — login modes and the security-posture panel, showing which other sign-in routes remain open.*

![Passkey Settings showing Login Modes and a security-posture summary that flags password and email-link sign-in.](/assets/images/passkey/settings.caa8e3de.png)

Why we built it

## Our payments are approved inside ERPNext.

Our bank transactions run inside our ERPNext. When a checker approves a payment, the money moves. There is no second approval on the bank’s portal.

The approval in ERPNext is now the only thing standing between a payment and the bank. We wanted it to be at least as safe as the bank’s own approval, ideally safer. Password plus OTP didn’t get us there. Passkeys did. We built passkey support for our own sign-in and payment approvals, and released it under the MIT licence.

[Why passkeys are safer, and when they aren’t →](/software/passkey/why-passkeys-are-safer/)

Engineering

## Built the Frappe way.

### Fits into Frappe

The codebase mirrors Frappe’s own structure: stored passkeys and settings are DocTypes in the app’s module, Passkey Settings is a single DocType like System Settings, and access follows Frappe’s role permissions, checked on the server. The app attaches only through sanctioned hooks and whitelisted endpoints, with no monkeypatching. One codebase serves Frappe v15, v16 and develop.

### Built on WebAuthn

Registration and sign-in implement the WebAuthn Level 3 relying-party verification steps. The [support guide](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/webauthn-l3.md) lists the browser features and limitations.

Install

## Up and running on your bench.

Install it with bench from the [GitHub repository](https://github.com/Andrometiq/frappe-passkeys). Use the branch for your Frappe version: version-15 for Frappe 15.108.0 or newer on that line, or version-16 for Frappe 16.18.3 or newer on that line. Python must be at least 3.10 and below 3.15. Serve the site over HTTPS.

bench get-app installs the Python requirements. If the WebAuthn wheel is missing later, for example after a manual checkout, run bench setup requirements for the app before enabling a mode.

### Turning it on

### Check the site and recovery path

Try the release on staging first. Set host_name or an explicit Passkey RP ID, then check the resolved RP ID and Passkey Origins in Passkey Settings. Changing the RP ID later invalidates enrolled passkeys. Back up the site and its encryption key, and test the [recovery procedure](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/recovery.md).

### Choose a login mode

Every login mode ships off. In Passkey Settings, turn on Login with Passkey, Passkey as Second Factor, or both. The second-factor mode needs Enable Two Factor Authentication in System Settings to stay on.

### Enrol and test a backup too

Start with a small group while password login remains available. Enrol and test a passkey and a backup for each user before closing their other ways in. Rehearse recovery before tightening the settings.

### Then close the other ways in

Use the security-posture panel to review password login, social sign-in and email links. Users can enable Passwordless login only at /passkeys; this is Passkey Only Login on their WebAuthn User Handle. For the passkey second factor, turn off Allow OTP Fallback for Passkey Second Factor to close the one-time-code option. A lost passkey then needs administrator recovery if no backup remains. The [operations guide](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/operations.md) explains site-wide password restrictions and Administrator’s recovery boundaries.

Documentation

## Everything else is in the docs.

### [Install](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/install.md)

Install or upgrade the app, with version and reverse-proxy requirements.

### [Configuration](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/configuration.md)

Every Passkey Settings field, its default and what changing it means.

### [Security model](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/security.md)

What the app enforces, what it trusts and the risks that remain.

### [Recovery](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/recovery.md)

Restore access for a locked-out user or administrator.

### [Custom UI](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/custom-ui.md)

Build your own screens or add passkey confirmation to your app’s actions.

### [REST API](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/rest-api.md)

Endpoint arguments, responses and authentication requirements for integrations.

### [Mobile apps](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/mobile-apps.md)

Configure a native Android or iOS app to share the site’s passkeys.

### [Operations](https://github.com/Andrometiq/frappe-passkeys/blob/develop/docs/operations.md)

Plan a rollout, manage domain changes and respond to credential incidents.

New to Frappe?

## The framework under ERPNext.

[Frappe](https://frappe.io) is the open-source framework [ERPNext](https://erpnext.com) is built on. This app installs into any Frappe site, ERPNext included, on the supported versions above.