Loading
Secure Your Salesforce Org
Passkeys for MFA

You are here:

  1. Salesforce Help
  2. Docs
  3. Secure Your Salesforce Org

Passkeys for MFA

Multi-factor authentication (MFA) verification is easy with a passkey (formerly known as built-in authenticator) service such as Windows Hello, Touch ID or Face ID, or a password manager. Users can quickly verify their identity with a fingerprint, iris, or facial recognition scan (or in some cases, with a PIN or password that the user sets up in their device's operating system). Passkeys provide secure, fast, easy login. They satisfy the phishing-resistant MFA requirement for privileged users.

Important
Important

Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines.

Passkeys are a great option if using a mobile authenticator app isn't viable. For example, consider this option for users who don't have a company-provided mobile device. And passkeys can make sense for PCI-compliant environments or situations where a user's work device doesn't have ports for a physical security key.

Important
Important This type of verification method is tied to a user's specific device. If a user logs in from multiple computers (for example, a desktop workstation and a laptop), they must either set up synced passkeys or register a passkey on each device. If passkeys aren't supported on all of a user's systems, non-privileged users can also register an alternate verification method such as Salesforce Authenticator.

Create a Passkey

For setup steps, see Create a Passkey. If you need help with passkeys, see Troubleshoot Passkey Issues.

Requirements and Considerations

  • Passkeys are automatically enabled as a verification method for all users.

  • After MFA enforcement, all users who don't meet MFA requirements see a prompt to create a passkey.

  • Salesforce supports passkeys managed through a Password Manager or cloud keychain, provided it is FIDO2/WebAuthn-compliant.

  • Before users can register a passkey with Salesforce, the service must be enabled on their device and set up to verify their identity via a biometric, PIN, or password.

  • A user's device, operating system, and browser must support the FIDO2 Web Authentication (WebAuthn) standard. For more information, check out the FIDO website and the WebAuthn guide.

  • Passkeys aren't supported in non-Chromium versions of the Edge browser.

  • Passkeys aren't available for Experience Cloud sites.

  • Users accessing Salesforce through an API can't verify their identity with a passkey.

  • Data Loader OAuth logins don't support the use of passkeys.

Note
Note Passkeys are currently supported in these Salesforce products only: All products built on the Salesforce Platform, Heroku, Marketing Cloud Intelligence, MuleSoft Anypoint Platform, and Tableau Cloud.

To learn more, see FIDO2: Web Authentication (WebAuthn) or the documentation for your users' passkeys.

Behind the Scenes

Registering a passkey creates a pair of private and public keys that are unique to the user's account. The private key is stored safely on the user's desktop or mobile device and is secured by the user's biometric data. The private key and the user's biometric data never leave the user's device and are never shared with Salesforce. When a user logs in to their account, the browser calls the device's operating system to launch the user's registered passkey. Depending on the user's browser and operating system, the user verifies their identity with a method like Touch ID, Face ID, or Windows Hello.

WebAuthn-compliant passkeys are resistant to phishing and man-in-the-middle attacks. A main reason is because a user's private key is bound to a domain associated with the user's account. For example, let's say a user is tricked into using a malicious site. When the site prompts the passkey to approve the login request, the authenticator recognizes that the site's domain isn't as expected and prevents the user from logging in.

 
Laster
Salesforce Help | Article