prepare('SELECT label FROM passkeys WHERE id = ?');
$st->execute([(int)($_POST['id'] ?? 0)]);
$label = $st->fetchColumn();
if ($label !== false) {
backup_db();
db()->prepare('DELETE FROM passkeys WHERE id = ?')->execute([(int)$_POST['id']]);
flash('Removed the passkey "' . $label . '".');
}
}
header('Location: passkeys.php');
exit;
}
$rp = webauthn_rp_id();
// Passkeys are bound to the host they were created on, so one made on
// localhost cannot sign in to the live domain. Listing the other hosts'
// keys separately explains why they are not usable here rather than
// hiding them and looking like they were lost.
$mine = db()->prepare('SELECT * FROM passkeys WHERE rp_id = ? ORDER BY id DESC');
$mine->execute([$rp]);
$mine = $mine->fetchAll();
$others = db()->prepare('SELECT rp_id, COUNT(*) n FROM passkeys WHERE rp_id <> ? GROUP BY rp_id ORDER BY rp_id');
$others->execute([$rp]);
$others = $others->fetchAll();
page_header('Passkeys');
?>
Passkeys
A passkey signs you in with your device’s fingerprint, face, or screen lock instead of the password.
The password keeps working — keep it somewhere safe as the way back in if you lose your devices.
Passkeys need a secure connection. This page was loaded over plain HTTP from
, so the browser will not allow them here. Load the site over HTTPS
(or via localhost) and this page will work.