HSID passkey FAQs

Question: Does the passkey setup prompt appear on every login, or is it a one‑time prompt per account?

Answer: Passkey step-up behavior is configured at the tenant level, not at the individual portal level. Currently, the tenant configuration requires passkey step-up during the first three successful logins for a user account. After these initial logins are completed, users will no longer be prompted for passkey step-up.

Question: If a user does not have a passkey set up, what login experience do they see?

Answer: If the user does not have a passkey:

1. User enters email.
2. User is prompted for password.
3. Phone verification (MFA) is completed.
4. Before landing on the portal dashboard, the user is prompted to create a passkey:
   • The user can skip this step.
5. If skipped, the user is redirected to the portal dashboard.
6. On future logins, the user can continue using password + MFA.

If the user creates a passkey:

• Clicking Continue redirects them directly to the portal dashboard.
• Subsequent logins will favor passkey authentication.

Question: Is a passkey device-specific, browser‑specific, or OS/platform‑specific, or OS/platform‑level?

Answer: In HSID, passkeys are browser- specific by default, with optional OS/platform-level sharing if the user enables it.

Passkeys can be shared across devices if platform sync is enabled:

• Chrome / Android → Google account sync
• Safari / iOS / macOS → iCloud Keychain
• Edge / Windows → Microsoft account

Important clarifications:

• HSID does not sync passkeys.
• Sync happens externally via the OS or browser account.
• Users must explicitly enable credential sync.

Question: Is there a limit on the number of passkeys per HSID user account?

Answer: Yes. A single HSID user account can register up to 6 passkeys.

Each passkey typically corresponds to:

• A device–browser combination, or
• A synchronized platform credential (e.g., Chrome + Google account).

Question: Is there a limit on how many accounts or passkeys a device or browser can store?

Answer: No HSID‑ enforced limit exists.

• HSID does not track or cap how many user accounts a device or browser can hold.
• Passkeys are stored in the browser or OS credential manager.
• Any practical limits are imposed by the browser or operating system, not HSID.

Question: What happens if a user with an existing passkey logs in from a new device or browser?

Answer: Authentication method

• HSID first checks for a local passkey.
• If no valid passkey is found:
  • User is offered password + MFA login.
  • User can explicitly select “Sign in with password”.

Login is always allowed.

Question: Is the user required to create a new passkey for the new device or browser?

Answer: No. Passkey creation is optional.

• Users can log in using password + MFA.
• After login, users may:
  • Add a new passkey via Manage Passkeys.
  • Skip passkey creation entirely.

If platform sync is enabled:

• The passkey may already be available.
• Login proceeds directly using passkey.
• No password or new passkey creation is required.

Question: Can one device or browser store passkeys for multiple HSID accounts?

Answer: Yes.

• A single browser or device can store passkeys for multiple HSID user accounts.
• At login, the browser/OS displays a credential picker.
• The user selects the appropriate account/passkey.

Question: What is the expected behavior when devices are shared within a household?

Answer: Fully supported.

HSID does not enforce:

• One account per device.
• One account per browser.
• One passkey per browser profile.

Question: Are passkeys shared across PROD, STAGE, or other environments?

Answer: No.

• Passkeys are strictly environment‑scoped.
• A passkey created in STAGE will not work in PROD.
• Platform sync does not override this behavior.

Each environment requires its own passkey setup, which is expected and intentional.