Workaround

You can implement a step-up authentication pattern using FusionAuth's WebAuthn API:

1. After the user completes email + password login, your application calls /api/webauthn/start
2. The authenticator produces a signature
3. Your application calls /api/webauthn/assert to verify possession of the passkey
4. Only grant access if the assertion succeeds

You can check whether a user has a registered passkey by calling /api/webauthn?userId={userId}.

Important limitation: This workaround runs in your application code, not inside FusionAuth's hosted MFA screen. Passkeys will not appear alongside email and authenticator app in the same native picker — you would need to build that UI and enforcement logic yourself in your application.

A feature request has been logged for native passkey MFA support in FusionAuth's hosted flow.

Related Documentation

• Authentication With WebAuthn & Passkeys - Complete guide to implementing WebAuthn/passkeys in FusionAuth
• WebAuthn API Reference - API endpoints for starting and completing WebAuthn authentication ceremonies
• Start a WebAuthn Passkey Assertion - Documentation for the /api/webauthn/start endpoint
• Retrieve a Passkey - How to check if a user has registered passkeys using /api/webauthn?userId={userId}
• Multi-Factor Authentication (MFA) - Overview of FusionAuth's native MFA methods (TOTP, email, SMS)
• Step-Up Authentication - General guidance on implementing step-up auth patterns in FusionAuth
• Can I do a step up authentication with WebAuthn/passkeys? - Community discussion on this exact use case