Passkeys in Multi-Device Ecosystems: Reference Architecture, Recovery, Telemetry, and Phishing-Resistant Authentication at Scale

Abstract—Passkeys extend WebAuthn/FIDO2 beyond a single browser API into a multi-device capability. The cryptography is mature, but deployments often struggle at the edges: device changes, recovery, cross-device flows, and inconsistent behavior across web and native surfaces. This paper provides a practical reference architecture, end-to-end flows, and an operational playbook (telemetry, SLOs, and failure taxonomy). We include a scenario-based evaluation using synthetic traces and de-identified event schemas so teams can adapt the approach to their environment.

Passkeys, WebAuthn, FIDO2, platform authenticators, multi-device sync, cross-device authentication, account recovery, risk-based policy, telemetry, CIAM, phishing resistance, incident response

1. World Wide Web Consortium (W3C). 2019. Web Authentication: An API for Accessing Public Key Credentials (WebAuthn). W3C Recommendation. https://www.w3.org/TR/webauthn/ [Google Scholar] [Crossref]

2. FIDO Alliance. 2020. FIDO2: Moving the World Beyond Passwords. Technical Overview. https://fidoalliance.org/fido2/ [Google Scholar] [Crossref]

3. National Institute of Standards and Technology (NIST). 2017. Digital Identity Guidelines: Authentication and Lifecycle Management (SP 800-63B). NIST Special Publication. [Google Scholar] [Crossref]

4. https://doi.org/10.6028/NIST.SP.800-63b [Google Scholar] [Crossref]

5. Joseph Bonneau, Cormac Herley, Paul C. van Oorschot, and Frank Stajano. 2012. The quest to replace passwords: A framework for comparative evaluation of web authentication schemes. IEEE Security & Privacy 10, 6 (2012), 14–22. https://doi.org/10.1109/MSP.2012.44 [Google Scholar] [Crossref]

6. Sasibhushana Matcha and Sreekanth Rachamadugu. 2026. Passwordless Authentication Systems: Architecture, Protocols, Security Analysis, and Large-Scale Impact. International Journal of Scientific Development and Research (IJSDR) 11, 1 (January 2026). [Google Scholar] [Crossref]

7. https://www.researchgate.net/publication/399681562_Passwordless_Authentication_Systems_Architecture_Protocols_Security_Analysis_and_Large-Scale_Impact [Google Scholar] [Crossref]

8. OWASP Foundation. 2023. Credential Stuffing Prevention. OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/ [Google Scholar] [Crossref]

9. Dick Hardt, Benjamin Kaduk, and Torsten Lodderstedt. 2023. OAuth 2.0 Security Best Current Practice. IETF RFC 9470. https://www.rfc-editor.org/rfc/rfc9470 [Google Scholar] [Crossref]

10. Michael Jones, John Bradley, and Nat Sakimura. 2015. JSON Web Token (JWT). IETF RFC 7519. [Google Scholar] [Crossref]

11. https://www.rfc-editor.org/rfc/rfc7519 [Google Scholar] [Crossref]

12. Trusted Computing Group. 2019. TPM 2.0 Library Specification. Trusted Computing Group Standard. https://trustedcomputinggroup.org/resource/tpm-library-specification/ [Google Scholar] [Crossref]

13. Apple Inc. 2024. Platform Security: Secure Enclave and Key Protection. Apple Developer Documentation. https://support.apple.com/guide/security/ [Google Scholar] [Crossref]

14. Microsoft Corporation. 2023. Zero Trust Deployment Center. Technical Guidance. [Google Scholar] [Crossref]

15. https://learn.microsoft.com/security/zero-trust/ [Google Scholar] [Crossref]