Royal TS or Royal Passwords should be able to act as a credential provider for passkeys itself, analogous to existing password credentials in the vault.
Desired behavior:
- Royal Passwords (browser extension) generates a FIDO2 key pair during registration
- Private key is stored encrypted in the Royal Vault
- During login, Royal Passwords signs the challenge independently, without an external hardware token
- Sync via team/vault possible, just like with shared password credentials
Use case:
More and more services (including Microsoft Entra ID / M365) support passkeys as the primary or recommended login method. Without native passkey management in the vault, users have to fall back on external tools for such logins, which undermines the benefit of centralized credential management.
Live example for testing: https://www.passkeys.io/