Passkey Recovery and Lockout: The Complete Guide for Relying Parties

Passkey Recovery and Lockout: A practical guide for relying parties that explains why passkeys cannot be reset and details causes of lockouts, recovery options, and operational controls. Key recommendations include enforcing a two-credential safety net (primary plus second registered passkey), offering offline one-time recovery codes, capturing AAGUID/BE/BS/transports/creation date at registration, using the WebAuthn Signal API to remove stale credentials, and avoiding SMS as a primary recovery mechanism while preserving assurance for high-value accounts.