A discoverable credential is a FIDO2 credential that the authenticator can locate without the user first entering a username or password. It is often called a resident credential because the credential lives on the device or platform. This supports passwordless sign in and smoother recovery across trusted devices.
Expanded Definition
A discoverable credential is a FIDO2 credential stored by the authenticator so it can be found without the user first typing a username or password. In practice, that means the device or platform can present eligible credentials during sign-in and support passwordless authentication flows. The term is often used interchangeably with resident credential, although product documentation can vary, so the exact retrieval behavior should be validated against implementation notes rather than assumed.
Discoverable credentials matter most when the organisation wants a faster login experience, local account recovery, or cross-device sign-in on trusted hardware. They differ from non-discoverable credentials, which require a username lookup before the authenticator can use the key. For identity teams, the operational question is not only whether the credential is discoverable, but where it is stored, how it is protected, and whether recovery paths preserve the same assurance as the original registration. NIST’s digital identity guidance helps frame those assurance expectations, while FIDO2 implementations determine the practical user experience.
The most common misapplication is treating any passwordless login as a discoverable credential, which occurs when teams conflate local device presence with FIDO2 resident key support.
Examples and Use Cases
Implementing discoverable credentials rigorously often introduces device-bound recovery and storage constraints, requiring organisations to weigh seamless sign-in against tighter authenticator lifecycle control.
- A workforce laptop enrolled with a platform authenticator lets employees sign in without entering a username, because the credential is discoverable on the device itself.
- A help desk recovery flow uses a trusted phone or security key to present the user’s stored credential after account verification, reducing password reset volume while preserving authentication assurance.
- An engineering team deploying NHI Lifecycle Management Guide patterns applies the same discipline to human sign-in credentials, ensuring registration, rotation, and revocation are tracked end to end.
- Security architects compare resident key behavior with the OWASP Non-Human Identity Top 10 to separate strong phishing-resistant authentication from weak fallback paths that reintroduce passwords.
- A shared kiosk deployment avoids discoverable credentials entirely, because local credential presence would create unacceptable account exposure if the device is reused or not hardware-protected.
For deeper context on adjacent secret handling risks, NHI teams often pair credential design reviews with Ultimate Guide to NHIs — Static vs Dynamic Secrets and the FIDO assurance expectations in NIST SP 800-63 Digital Identity Guidelines.
Why It Matters in NHI Security
Discoverable credentials reduce password reliance, but they also shift risk into credential storage, device compromise, and recovery governance. If the authenticator is stolen, poorly protected, or enrolled without strong device binding, the attacker may gain a ready-made authentication path. That is why discoverable credential design should be reviewed alongside secret handling, enrollment assurance, and revocation procedures rather than as a standalone UX feature. NHI programmes that already struggle with credential sprawl should be especially cautious, because convenience can obscure whether access is truly controlled or merely hidden on a device.
This matters in the broader NHI context because credential portability and recovery often mirror the same failure patterns seen in exposed secrets and unmanaged service identities. NHIMG’s 2024 Non-Human Identity Security Report found that 88.5% of organisations say their non-human IAM practices lag behind or are only on par with human IAM, while 23.7% still share secrets through insecure methods such as email or messaging applications. Those indicators show how easily convenience can outpace governance when credential flows are not tightly controlled. Organisations typically encounter the consequences only after a device loss, account takeover, or failed recovery event, at which point discoverable credential handling becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | Defines digital identity assurance expectations for phishing-resistant authenticators. |
| OWASP Non-Human Identity Top 10 | NHI-02 | Credential storage and exposure risks map to improper secret and identity management concerns. |
| NIST CSF 2.0 | PR.AC-1 | Identity proofing and access enforcement support controlling who can use a discoverable credential. |
| NIST Zero Trust (SP 800-207) | PA-1 | Zero Trust requires continuous trust evaluation rather than assuming device-held credentials are safe. |
| NIST AI RMF | Risk governance applies when credential discovery improves usability but expands attack surface. |
Use FIDO2 discoverable credentials only within assurance-bound sign-in flows that meet the required AAL.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
