In the June 14, 2025 2025.3 major Kahua release, Kahua will be adding passkeys as multi-factor authentication (MFA) option for all customer domains. Passkeys allow you to prove your identity by logging in from a supported device, rather than by the use of a password. For general information on passkeys, refer to this link.
For more information on using passkeys with Kahua, refer to the following FAQs:
Q: How do I enable passkeys?
Domain administrators will be able to enable passkeys via the existing MFA authentication group settings. Administrators will now see a third toggle for passkeys.
Q: What happens if I lose my device?
Domain admins can go into the user’s app and deactivate a user's passkeys. After that, the user will be prompted to register a new passkey when they attempt to login.
Q: Can I deactivate a stored passkey?
Only a domain administrator can deactivate a user’s passkeys. Note: If a user manually deletes a passkey from their device, they must also have the domain admin deactivate the user passkey from the Users App.
Q: Will passkeys be enabled by default?
No, passkeys will be available as an optional authentication option.
Q: How are passkeys more secure than traditional passwords?
Passkeys allow users to authenticate using familiar methods, such as a PIN, facial recognition, or other secure authentication options supported by their device. When a user creates a passkey, their account becomes linked to their device, ensuring that only someone with access to that device and the user's biometrics can sign in. The private key never leaves the user's device, meaning that neither nefarious actors nor Kahua will ever have access to the password.
Q: Do I need to scan the QR code with an app or my camera?
If linking a mobile device for example, it does not matter if you use an authenticator app or the native camera app on the device. The operating system on the device is what controls this process.
Q: Does Kahua have access to my passkey?
No, Kahua only knows the public key whereas the private key is stored on the user’s device.
Q: Can I add another passkey to my account?
Yes, if you have already created a passkey, you will see an option to add additional passkeys in your user settings. This option is accessed through the My Settings > Security tab.
Note: You will not be able to register multiple passkeys on the same device.
Q: Is my phone the only device I can register?
No, passkeys are supported by many devices. These could be phones, laptops, or even security keys.
Q: Are passkeys synced?
Yes, services such as iCloud Keychain and Google Password Manager allow a user to use multiple devices so long as they are signed in to both with the same account.
Q: Can I enable passkeys for external user authentication?
Yes, passkey support for External Authentication will also be added in the 2025.3 release.