Introducing Passkey Authentication by Vonage

Introduction

We're excited to announce that Vonage now supports passkey (passwordless) authentication. Passwords have been the backbone of online security for decades, but they've also been one of its biggest weaknesses. Stolen credentials, phishing attacks, and credential-stuffing are among the most common causes of account compromise today.

What is a Passkey?

A passkey is a modern, passwordless authentication credential based on the FIDO2/WebAuthn standard, the same technology adopted by Apple, Google, and Microsoft as the future of authentication.

Instead of a password, a passkey uses a cryptographic key pair:

• A private key is stored securely on your device (or in your password manager). It never leaves your device.

• A public key registered with Vonage is used to verify your identity without ever transmitting a secret over the network.

When you log in, your device signs a cryptographic challenge using the private key after you verify your identity via biometrics (Face ID, Touch ID, Windows Hello) or a device PIN. Vonage verifies the signature using the stored public key. No password is ever sent or stored.

Passkeys can be synced across your devices via iCloud Keychain, Google Password Manager, or third-party managers like 1Password and Keeper.

Why Passkeys?

Passkeys are a secure alternative for authentication without having to remember a password or even store it on a password manager, as it's securely stored in your trusted device and are resistant to phishing.

Reasons That Make Pass Keys Stand Out

• Phishing-resistant: The private key is cryptographically bound to the registered domain. It simply cannot be used on a fake site.

• Non-exportable: The private key cannot be extracted from most devices, making it impossible to steal via data breaches.

• No shared secret: Unlike passwords or TOTP codes, nothing sensitive is transmitted during authentication.

• No separate MFA required: A passkey alone satisfies both "something you have" and "something you are/know", so there's no need for a separate second factor.

• Cross-device: if you don't have your passkey on the current device, you can authenticate via QR code scan from another device, or use a FIDO2 hardware security key.

How Passkeys Work

Registration

When you create a passkey, your device generates a public/private key pair. The public key is stored on Vonage's servers; the private key never leaves your device or password manager.

Authentication

At login, Vonage sends a cryptographic challenge. Your device signs it with the private key (after you verify your identity via biometrics or PIN) and returns the signature. Vonage verifies the signature using the stored public key, and no password is required.

Cross-Device Login

If your passkey isn't stored on the current device, you can:

• Scan a QR code with the camera on the device that holds your passkey.

• Use a hardware security key; insert and touch a FIDO2 USB or NFC token.

Getting Started

Passkeys are natively supported by all major platforms and browsers (Apple, Google, Microsoft). They can be synced across devices via iCloud Keychain, Google Password Manager, or third-party managers such as 1Password and Keeper. For detailed information on how to get started with using a passkey, check the documentation page.

Logging In with a Passkey

The Vonage login page now includes a "Log in with a passkey" button below the standard email/password form. If you've already registered a passkey, simply click it to authenticate without entering your email or password.

Login with a passkey

Creating Your First Passkey

After logging in, you'll be presented with a "Start using passkeys" screen that walks you through the setup. You can also:

• Optionally choose "Also remove my password": this deletes your password and enforces passkey-only login for maximum security.

• Dismiss the prompt and create a passkey later from your Account Security settings.

Manage Your Passkeys

A new "Manage your registered passkeys" section is available on your Account Security page.

Passkey management
From there, you can:

• View all registered passkeys with their credential name (e.g., Keeper, 1Password) and registration date.

• Remove individual passkeys at any time.

Your existing 2FA methods (SMS / WhatsApp, Authenticator App) remain available alongside passkey management.

What If I Lose Access to My Passkey?

If you lose access to your passkey (e.g., lost device or deleted credential), you can recover access via the standard password reset flow, which includes a second-factor check. Once logged in, you can create a new passkey from the Account Security page.

Conclusion

Passkeys represent a fundamental shift in how authentication works, moving away from shared secrets toward cryptographic proof of identity. By supporting passkeys, Vonage joins Apple, Google, and Microsoft in adopting the industry standard for secure, frictionless authentication.

Whether you're a developer building on the Vonage platform or an end user managing your account, passkeys make your experience both simpler and more secure.