Best Practice for Passkey Re-authentication in Account Management Flows

Get Help
1

Hi Auth0 Team,

We have implemented passkeys for user sign-in. Previously, for sensitive account management actions (e.g., Change Email), we required users to re-enter their password. We now want to replace that verification step with passkey-based re-authentication.

Could you please advise on the recommended Auth0 approach?

  1. For passkey users, should we implement re-authentication using a WebAuthn assertion (navigator.credentials.get) against a fresh challenge, or is there an Auth0-recommended step-up authentication flow that achieves the same result?
  2. If a fresh challenge is required:
    • Which Auth0 API should we use to generate the challenge?
    • We need to provide the Application (Client) ID when generating the challenge. What clientId should that be, and what extra config do we need for that app to do so?
  3. After the UI returns the WebAuthn assertion response:
    • Which Auth0 API should be used to verify it?
    • What validation steps are expected on the backend?
  4. Are there any Auth0 best practices for enabling passkey verification before sensitive account management operations?

We’re looking to align with industry best practices for passkey-based re-authentication and would appreciate any recommended implementation flow.

Current implementation: We have an SPA application in the UI, and the change email operation is performed by our backend API using Auth0 management APIs

Thanks!