Enroll a WebAuthn factor and configure Auth0 MFA passkeys via the Auth0 Management API and Actions
domain: auth0.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Enable WebAuthn (passkeys) as an MFA factor in the Auth0 Dashboard under Security > Multi-factor Auth, or via the Management API PATCH /api/v2/guardian/factors/webauthn-roaming or webauthn-platform.
To enforce WebAuthn as the only factor or as a step-up trigger, configure an Auth0 Action on the post-login trigger that checks event.authentication.methods and calls api.authentication.challengeWith({ type: 'webauthn-roaming' }) or 'webauthn-platform'.
For self-service enrollment, redirect users to the Auth0 Universal Login MFA enrollment flow; Auth0 handles the WebAuthn ceremony, stores the credential, and associates it with the user's profile.
To list or delete a user's enrolled WebAuthn authenticators, call the Management API GET/DELETE /api/v2/users/{user_id}/authenticators.
For passkeys as a primary authentication factor (passwordless), enable the passkeys feature in Auth0 and configure the identifier-first login flow; the challenge and ceremony are handled by Auth0's hosted pages.
Known gotchas
Auth0 manages the WebAuthn challenge lifecycle internally; do not attempt to intercept or replay challenges issued by Auth0's hosted pages — they are single-use and server-validated.
The webauthn-platform and webauthn-roaming factors are managed separately; a user enrolled in platform (Touch ID) is not automatically enrolled in roaming (security key) and vice versa.
Management API tokens used to read or delete authenticators require the read:authenticators and delete:authenticators scopes; these are sensitive scopes that should not be granted to client-side applications.
Give your agent this knowledge — and 15,800+ more routes
One MCP install gives any agent live access to the full route map across 5,800+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?