Document passkey "upgrade" behavior (#45254)

* Document passkey "upgrade" behavior * Grammar/capitalization Co-authored-by: Paul Gottschling <[email protected]> --------- Co-authored-by: Paul Gottschling <[email protected]>
gravitational · Aug 13, 2024 · 7086f7a · 7086f7a
1 parent db827bf
commit 7086f7a
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/docs/pages/admin-guides/access-controls/guides/passwordless.mdx b/docs/pages/admin-guides/access-controls/guides/passwordless.mdx
@@ -333,3 +333,14 @@ $ tctl create -f cap.yaml
 
 </Tabs>
 
+### Why did my multi-factor authentication (MFA) device become a passkey?
+
+If your MFA authenticator suddenly started being listed as a passkey, that is
+because it was always a passkey. Certain devices or applications (like Chrome or
+Safari Touch ID keys) are always created as passkeys, despite instructions from
+Teleport.
+
+If an authenticator replies with the [credProps extension](
+https://w3c.github.io/webauthn/#sctn-authenticator-credential-properties-extension)
+during registration, or is used for a successful passwordless login, Teleport
+will automatically mark it as a passkey if that wasn't the case before.