Can login passkey and MFA passkey be merged into one credential?

Get Help
, , , ,
1

What we want to achieve

We’re building a custom Universal Login (ACUL) with React. We need passkeys in two scenarios:

  1. Login passkey — Users authenticate directly with a passkey on the login page (Discoverable Credential)
  2. MFA passkey — For step-up authentication on sensitive operations, users verify via MFA WebAuthn Platform (Non-Discoverable Credential, enrolled on the mfa-webauthn-platform-enrollment screen)

The problem

These are two separate credentials. Users must register a passkey twice — once for login, once for MFA. This creates two issues:

  1. Double registration feels redundant — The user just authenticated with their fingerprint to log in, then is immediately asked to “Create Passkey” again for MFA enrollment.
  2. Duplicate entries in the OS passkey picker — Both credentials appear under the same email with no way to distinguish which is for login vs MFA (see screenshot below).

image (2)
image (2)1920×896 150 KB

What we’ve already considered

  • max_age=0 for step-up: Forces full re-authentication, but this redirects the user back to the login page — unacceptable UX for in-app step-up.
  • Post-Login Action to skip MFA after passkey login: We know we can check event.authentication.methods for "passkey" and call api.multifactor.enable("none"). This solves the login flow, but doesn’t help with step-up — we still need MFA for sensitive operations.
  • We understand the technical difference: Login passkeys are Discoverable Credentials; MFA WebAuthn Platform credentials are Non-Discoverable. Auth0 treats them as separate systems.

Our question

  1. Is there any way to unify these into a single passkey credential that works for both login and MFA step-up?
  2. If not, is there a recommended approach for step-up authentication that avoids requiring a second passkey registration, or distinguish the mfa and login passkeys for a same user?
  3. Any plans on the Auth0 roadmap to address this?

Authentication Profile: Identifier First
Auth0 SDK: @auth0/auth0-acul-react v1.0.0