Passkey

About

payload-passkey adds WebAuthn passkey authentication to Payload CMS by wrapping Better Auth and the @delmaredigital/payload-better-auth integration. It injects a passkey login button into Payload's default login screen and adds passkey enrollment and management controls to the account view, built with Payload's own UI components so they match the admin design language. The plugin registers the Better Auth collections (accounts, passkeys, sessions) against your user collection and adds the fields they depend on, including emailVerified, image, and a passkey management field. Configuration covers the WebAuthn relying party (rpID, rpName, origin), the Better Auth baseURL and secret, trusted origins, and a generateId strategy that should be set to "serial" on PostgreSQL with default IDs. Session lifetime is controlled through sessionSeconds, with a refresh buffer (sessionRefreshBufferSeconds) and an admin provider that refreshes the Better Auth token before it expires. Passkey login can run alongside Payload TOTP when enableTotpCompatibility is true. In that mode the plugin switches to a passkey-as-TOTP strategy so a passkey satisfies the second factor. Collection hooks revoke Better Auth sessions when a user enables or rotates TOTP, on login, and on logout, where an allSessions flag clears every session for the user. The plugin preserves Payload's native email and password login rather than replacing it. i18n ships English and Japanese translations and is marked beta.

Package info

Package name

payload-passkey

Latest version

2.1.1

Unpacked size

124 kB

License

MIT

Weekly downloads

487

Last publish

Sep 27, 2026