Security key rollouts involve three separate decisions: how the key is used, how the server identifies it and what the user sees when they touch it. Most implementation problems start when these get mixed up. The numbers below come from real registrations in the Passkeys Debugger , so you can reproduce them with your own key.

Two ways to use a security key

The key does not decide how it is used. The relying party does, through the options it sends to navigator.credentials.create() .

Mode residentKey userVerification User experience Storage on the key

Second factor (U2F-style) discouraged discouraged Password, then touch Nothing, the private key is wrapped into the credential ID

Passkey on the key required required Touch plus key PIN One slot per account

// Security key as second factor (U2F-style) const credential = await navigator . credentials .…