Passkeys provide a secure and convenient way to verify your identity using supported devices, password managers, and hardware security keys.
CarDorLabs uses Authentik to manage passkeys and other multi-factor authentication (MFA) methods.
Depending on your device, you may be able to use:
- Windows Hello
- Apple Face ID or Touch ID
- Google Password Manager
- Android or iPhone
- Hardware security keys, such as YubiKey
You can register, rename, and remove passkeys through the CarDorLabs Authentication Portal.
Make sure you have:
- Your CarDorLabs username and password.
- Access to your existing MFA method, if prompted during sign-in.
- A compatible browser and device, password manager, or security key.
Note: The exact passkey setup screens vary depending on your browser, operating system, and chosen passkey provider.
- Sign in to the CarDorLabs Authentication Portal.
- Click the Settings (gear) icon in the upper-right corner.
- Select Credentials from the menu on the left.
- Locate the MFA Devices section.
This section displays your registered authentication devices, including TOTP authenticators and WebAuthn passkeys.
From here, you can enroll new devices, rename existing devices, or remove devices you no longer use.
- Under MFA Devices, click Enroll.
- Select WebAuthn device from the dropdown menu.
- Your browser or operating system will prompt you to choose where to create or save your passkey.
- Select your preferred passkey provider or device.
- Follow the instructions displayed by your browser or operating system.
- Complete any required fingerprint, facial recognition, PIN, or security key verification.
When using Google Chrome:
- Select Google Password Manager when prompted to choose where to save your passkey.
- Review the account information displayed.
- Click Create.
- Complete any additional verification requested by Google Password Manager.
After successful registration, Chrome confirms that the passkey has been saved.
Return to Settings → Credentials.
Your new passkey should appear in the MFA Devices list with its type displayed as WebAuthn Device.
For example:
- Name: Google Password Manager
- Type: WebAuthn Device
Important: Registering a passkey does not necessarily mean it will immediately replace your existing sign-in method. Available authentication methods depend on the CarDorLabs authentication configuration.
Giving your authentication devices descriptive names makes them easier to identify and manage.
To rename a passkey:
- Open Settings → Credentials.
- Locate the passkey in the MFA Devices list.
- Click the Edit icon under Actions on the right.
- Enter a descriptive name.
- Save your changes.
- Home Desktop
- Work Laptop
- Google Password Manager
- Samsung Galaxy
- YubiKey
Your updated device name will appear in the MFA Devices list.
If you replace a device, stop using a password manager, or no longer need a registered passkey, you can remove it from CarDorLabs.
- Open Settings → Credentials.
- Locate the passkey you want to remove under MFA Devices.
- Select the checkbox beside that device.
- Click Delete above the device list.
- A Delete Device(s) confirmation window will appear.
- Verify that the correct device is listed.
- Click Delete to confirm.
The passkey will disappear from the MFA Devices list.
- Removing a passkey from Authentik prevents that credential from being used to authenticate with CarDorLabs.
- Deleting a passkey from Authentik does not necessarily remove its saved copy from your password manager or device.
- You may also want to delete the corresponding passkey from Google Password Manager, Windows, Apple Passwords, or whichever provider originally stored it.
- Removing one passkey does not remove your other registered MFA devices.
Security note: The current CarDorLabs configuration requires confirmation before deleting a passkey but does not require an additional email verification code during removal.
- Register more than one authentication method. For example, maintain a TOTP authenticator and a WebAuthn passkey.
- Use descriptive device names. This helps you recognize unfamiliar or outdated credentials.
- Remove credentials you no longer use. Especially those associated with lost, replaced, or retired devices.
- Protect your password manager. Use a strong password and enable MFA on the account that stores your passkeys.
- Never approve an authentication request you did not initiate.
- Keep your CarDorLabs password secure, even when using passkeys.
Verify that:
- Your browser supports WebAuthn.
- Your operating system supports passkeys or security keys.
- Your chosen password manager or security key is configured correctly.
- Any required device security features, such as a PIN or biometric authentication, are enabled.
Try another supported browser or device if necessary.
- Return to Settings → Credentials.
- Click Refresh in the MFA Devices section.
- Check whether your passkey appears as a WebAuthn Device.
If registration was interrupted, repeat the enrollment process.
This is expected behavior.
Removing a passkey from Authentik invalidates its registration with CarDorLabs but does not automatically delete the credential stored by your passkey provider.
Open your password manager or device's passkey settings and remove the corresponding credential if you no longer need it.
If you have another registered MFA method, you may still be able to authenticate using that method.
If you cannot access your account:
Administrators can find deployment, configuration, and troubleshooting documentation in the Authentik section of the IT Knowledge Base.