Passkey Authentication for Salesforce Digital Experience (Community Cloud) — Part 1

This article guides you through implementing passkey authentication for Salesforce Digital Experience (Community Cloud). Part 1 covers registration; Part 2 covers authentication.

What is passkey authentication?

Passkeys are unique digital keys that replace traditional passwords. They are cryptographically secure, stored locally on the user's device, and never transmitted over the internet — which makes them immune to phishing and social engineering.

The technology behind it

Passkey authentication is based on WebAuthn and public key cryptography. A public/private key pair is generated on the user's device: the public key is shared with the site, the private key never leaves the device. At login the site sends a challenge, the device signs it with the private key, and the site verifies the signature.

Salesforce setup

Salesforce currently supports WebAuthn only as a second factor, so users cannot log in with it out of the box. With the platform's flexibility we can add it ourselves: an LWR community template with LWC components triggers the browser navigator.credentials methods, while Apex stores and validates keys and digital signatures.

Pre-registration steps

• Community details: host and name.
• User details: user ID, user name and display name.
• Challenge: a randomly generated string that the user's device will sign.

Passkey registration can be triggered for both authenticated and unauthenticated users. In this demo we add a passkey as an alternative authentication method for users who already have an account.