In my opinion, the passkey-related API has major flaws that basically prevent this from being implemented in a provider-independent way.
It may work with the Auth0 login flow, but it does not work with a custom authentication implementation.
One of the biggest issues is that Auth0 automatically generates the user_handle. See the discussion here:
Most companies want to keep all relevant identity and authentication data in their own systems so that they can change authentication providers or restore their data in case of an emergency.
Passkeys are a good example. If a company wants to migrate from Auth0 to another authentication provider, the current implementation would mean that the existing passkeys cannot be transferred. As a result, all users would be forced to register new passkeys.
The automatically generated user_handle is one of the things that fundamentally prevents this.
The user_handle should be controlled by the master identity system. If Auth0 generates its own user_handle, the passkey credential becomes tied to Auth0’s internal identity representation.
This makes the credential effectively non-portable between authentication providers.
In my opinion, the API should allow the customer to provide the user_handle when creating/registering a passkey.
Otherwise, it is very difficult to build a provider-independent passkey implementation where the customer remains in control of their own identity data.