Notifications
Clear all
Topic starter
16/08/2026 1:12 pm
TL;DR: Cross-device passkeys solve a usability problem, but they also expose a governance gap: identity systems still need explicit device migration, verification, and recovery logic when an authenticated user moves between endpoints, according to Descope. For IAM teams, the issue is not passkey support itself, but whether authentication, lifecycle, and recovery controls stay consistent across devices and channels.
NHIMG editorial — based on content published by Descope: Cross-device Passkey Implementation Guide
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams handle passkey login when users switch devices?
A: They should treat device switching as part of the authentication lifecycle, not as an exception.
Q: Why do passkeys not eliminate the need for recovery controls?
A: Passkeys reduce phishing and password reuse, but they do not remove account recovery.
Q: What do security teams get wrong about passwordless authentication?
A: The most common mistake is treating passwordless as a user-experience upgrade instead of an identity control change.
Practitioner guidance
- Map passkey enrollment to identity lifecycle states Define how a user moves from first registration to device replacement, revocation, and recovery.
- Restrict fallback verification to bounded recovery paths Use email OTP or similar proofing only when a new device cannot present an existing passkey.
- Test device migration as a standard authentication scenario Run cross-device sign-in tests for laptop-to-phone, phone-to-laptop, and lost-device recovery.
What's in the full article
Descope's full post covers the implementation detail this analysis intentionally leaves for the source:
- React SDK setup steps, including project ID wiring and Flow ID configuration for cross-device passkeys
- The exact passkey-cross-device flow logic that checks whether a user already exists before updating bindings
- Phone-to-laptop and laptop-to-phone test paths, including QR-based cross-device login
- Integration examples for teams using SAML or OIDC providers alongside passkey flows
👉 Read Descope's guide to cross-device passkey authentication →
Cross-device passkeys: are your authentication controls keeping up?
Explore further
16/08/2026 1:13 pm
Cross-device passkeys expose an authentication continuity problem, not a pure login problem. The real governance issue is whether identity assurance survives device changes without forcing users into inconsistent fallback paths. When teams treat passkey setup as a single event instead of a lifecycle, they create gaps between first enrollment, replacement device access, and recovery. Practitioners should frame this as authentication continuity across the user lifecycle, not as a one-time MFA replacement exercise.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: How do you know whether a passkey programme is actually working?
A: A passkey programme is working when password use, phishing success, and reset-related support demand all decline without increasing account recovery incidents or access exceptions. Track login success, fallback usage, recovery events, and the proportion of applications still outside the passkey policy boundary.
👉 Read our full editorial: Cross-device passkeys expose the real governance gap in CIAM
