Cloudflare Access adds passkeys as a login method

A 6 November Cloudflare changelog says Cloudflare Access now supports passkeys as a login method for protected applications and the App Launcher. Users can sign in with a passkey saved on a device, a security key or a password manager, instead of entering a password or a one-time PIN.

“Users can sign in with a passkey instead of entering a password or one-time PIN (OTP).”

— Cloudflare, in its Passkeys documentation

The docs say passkeys use WebAuthn. The authenticator has to support discoverable credentials and user verification, such as a fingerprint, face scan or PIN.

Administrators add Passkeys as an identity provider under Zero Trust, then choose which applications accept it, including the App Launcher. They can optionally have the login page open the browser’s passkey prompt for returning users. The same setup is available through the Identity Providers API, with the type set to passkeys.

Enrolment and sign-in with a passkey don’t, on their own, grant access. Users still have to match an Access policy. Passkey authentication also doesn’t retrieve group memberships or custom attributes from another identity provider, so policies that depend on those attributes need a review before passkeys are added as an alternative login method.

To enrol a passkey, users first verify their identity with an available login method. If passkeys are the application’s only login method, Access sends a verification code to their email address during enrolment. After a passkey is saved, they don’t need to enter an email address to sign in with it. If automatic prompts are on, users can cancel them and choose another allowed login method.

Users can add, rename or delete their own passkeys from the Access login page. Administrators can delete a registered passkey from a user’s identity in the dashboard or through the API, which stops Access accepting it for future sign-ins. Official docs say that doesn’t end the user’s active Access sessions — those have to be revoked separately.

Cloudflare Access now supports passkeys as a login method. Wave goodbye to one-time PINs and IDP configuration.

https://t.co/T2rXYT7Mi4

— Cloudflare Changelog (@CFchangelog) November 7, 2026

Cloudflare Access now supports passkeys.

Sign in to protected apps with a device passkey, security key, or password manager instead of a one-time PIN.

Admins pick which apps accept them.

You can automatically prompt passkeys on the login page.

— Cloudflare Developers (@CloudflareDev) November 11, 2026