Resource Access Management:What is a passkey?

Benefits

Security

• Passkeys are based on the FIDO2 standard, which uses public key cryptography to deliver phishing-resistant authentication. When you register a passkey with a service, your device creates a unique cryptographic key pair. The private key is securely stored on your device and never leaves it, while the public key is registered with the service. This ensures that your credential cannot be phished or compromised on a different site. For more information, visit the FIDO Alliance official website.

• Passkeys eliminate the risks associated with plaintext passwords, such as leaks from server breaches, sharing, or weak password practices.

Confidentiality

Your biometric data (fingerprints and face ID) never leaves your device and is not transmitted to Alibaba Cloud. The cloud service only receives a confirmation that your device successfully authenticated you.

Convenience

• Passkeys let you log on instantly using your device's built-in biometrics or PIN, eliminating the need to type passwords or one-time verification codes.

• Because passkeys are inherently multi-factor (combining something you have—the device, with something you are—biometrics, or something you know—a PIN), they satisfy MFA requirements on their own when used for signing in.

Limits

• A RAM user can register a maximum of five passkeys. We recommend registering passkeys on all your frequently used devices to ensure seamless access.

• Each passkey registered to a RAM user must have a unique name.

• By default, RAM users can register passkeys for use as a second factor (MFA). To allow users to log on with a passkey as their primary authentication method, a RAM administrator must enable this feature in the account's security settings. For more information, see Log on with a passkey.

Supported device types

Security keys

Any security key that is FIDO2-certified is supported. This includes devices that connect via USB, NFC, or Bluetooth. Older U2F-only keys may not be compatible.