Signing in with a passkey through a system sign-in sheet

The situation

A person with only a passkey was unable to sign in to an app window because it required a provisioning profile. The app already had a working sign-in process for iPhone users, which used a system sign-in sheet and a one-time web sign-in link. The goal was to enable passkey sign-in for the app window without requiring a profile or server changes. The existing sign-in process for iPhone users was a possible solution, but it needed to be adapted for the app window. The app window was unable to run a passkey, so a new approach was needed. The existing process used a system sign-in sheet and a one-time web sign-in link, which could be reused for the app window.

What they weighed

• Use the system sign-in sheet and one-time web sign-in link with no server changes

  Chosen

• Create a provisioning profile with associated domains and add the app to the passkey file

• Exclude passkeys from the app window and rely on emailed codes

What they decided

Use the system sign-in sheet and one-time web sign-in link with no server changes

Why

This approach reuses the existing server process, needs no profile or server changes, and keeps no token. The system sign-in sheet shares passkeys, allowing a passkey-only person to sign in. The one-time web sign-in link then puts the normal session in the app window. This solution was chosen because it is efficient and does not require additional infrastructure. It also provides a seamless experience for users with passkeys.

The first step

Add the system sign-in sheet to the app code, build the native executable, install it, and test with a proof account

How they would know it worked

A proof account successfully signs in from the installed app window through the system sign-in sheet and the app window shows the signed-in app

How it turned out

Not known yet. The result is added here when it comes in.