First passkey enrollment blocked by mandatory Post Login Action — supported bootstrap flow?

Get Help
1

Hello Auth0 Community,

What is the supported way to enroll a FIRST primary passkey for an existing, email-verified Database user when a Post Login Action requires passkey authentication?

Current configuration:

  • The user has a password but no registered passkey.

  • Passkeys and Local Enrollment are enabled.

  • Progressive Enrollment is OFF and must remain OFF.

  • Public signup is disabled and must remain disabled.

  • A deployed Post Login Action rejects password-based authentication with PASSKEY_REQUIRED / access_denied.

  • That Action must remain unchanged.

  • Existing users’ passkeys must remain unaffected.

A controlled attempt with Progressive Enrollment temporarily enabled did not register a passkey and ended in the Post Login denial. Progressive Enrollment was restored to OFF. We do not want to repeat that experiment without a confirmed compatible flow.

My Account API is available but has not been activated. Its enrollment flow appears to require an already authenticated user, which creates a bootstrap problem for the protected application.

We also understand that the Management API endpoint for creating authentication methods expects a credential whose verification has already been completed; it does not replace the user’s WebAuthn enrollment ceremony.

Is there an officially supported enrollment-only flow, administrative invitation, or recovery procedure that can:

  1. Enroll the first primary passkey for this existing account.

  2. Preserve the current RP ID and existing users’ credentials.

  3. Keep the mandatory Post Login Action unchanged.

  4. Keep Progressive Enrollment OFF and public signup disabled.

  5. Avoid granting access to the protected application before passkey authentication succeeds?

If a separate enrollment-only application with My Account API is the supported approach, what authentication flow, hosting origin, RP ID requirements, and minimum scopes are necessary?

Please distinguish primary passkey enrollment from WebAuthn MFA enrollment. Links to official documentation or a supported end-to-end example would be appreciated.

Thank you.