If you or your users run into problems when trying to create a passkey, there are a few common causes you can check and resolve. Use the sections below to identify the issue and get back on track.
đNote: Passkeys are enabled at the org level by Salesforce as part of MFA enforcement. Admins do not need to configure passkey settings manually.
Common symptoms
Users can encounter passkey creation issues in these ways:
The browser prompt times out or shows This device cannot be used.
Nothing happens after clicking Create Passkey in the passkey prompt.
After selecting Cancel in the browser dialogue, an error message prevents the user from continuing.
Passkey requirements
To create and use a passkey, users need a supported browser, device, and operating system, plus at least one way to verify their identity.
Supported browsers
Users must be on one of the following browsers:
Chrome
Edge
Firefox
Safari
Supported identity verification methods
Users also need at least one of the following:
Apple device users: a password-protected user account, Face ID, Touch ID, or another method supported by their Mac, iPhone, or other Apple device.
Windows users: Windows Hello with a PIN, fingerprint scanner, or face scanner.
A physical security key, such as a YubiKey or Titan key.
Another device, such as a phone or tablet, that supports passkeys, users can scan a QR code on the device where they want to log in, then verify their identity using the passkey on their phone or tablet.
Users: verify passkey requirements
You can check whether your browser, device, and operating system support passkeys by following these steps.
Confirm you are using a supported browser: Chrome, Edge, Firefox, or Safari.
Confirm your device and operating system support passkeys.
If your current device does not support passkeys and you do not have a hardware security key, check whether you have another device that supports passkeys, for example, a phone or tablet with a device PIN or Face ID, that you can use to log in to your Salesforce account on another device.
For detailed steps to create a passkey, see Create a Passkey.
Use the same passkey on more than one computer
If you want to use the same passkey on more than one computer, you will need a password manager such as Google Password Manager. The passkey will need to be deleted and then added back so it can be linked in the Password Manager option and synced.
đNote: Before doing the steps below, ensure you have a password manager installed on the computer.
Click View profile, then click Settings, then click My Personal information, then click Passkeys, then click Delete Passkey.
Once you have deleted the passkey, you will be prompted to add a new passkey. Select Password Manager, for example, Google Password Manager.
For further assistance, please refer to the link below for the steps required.
Admins: understand org-level passkey settings
Passkeys are enabled at the org level. As part of MFA enforcement, Salesforce sets the verification method settings on the Identity Verification page in Setup. Admins do not need to configure these settings.
đNote: To view identity verification settings, Salesforce admins need the Customise Application permission.
The following settings are configured by Salesforce and should appear as shown below:
Let users verify their identity with a built-in authenticator (passkey) such as Touch ID or Windows Hello: on.
Let users verify their identity with a physical security key (passkey) such as U2F or WebAuthn: on.
Show all permitted verification method options for MFA registration: off. With this setting off, MFA registration begins with passkeys instead of showing all verification methods.
â ď¸Important: These settings are managed by Salesforce. If any of the above settings appear differently in your org, raise a case with Salesforce support.
Required editions and permissions
Passkey creation is available in both Salesforce Classic and Lightning Experience, across all editions.
User permissions needed
Salesforce admins who need to view identity verification settings require the Customise Application permission.