Proposal: passkey (WebAuthn) sign-in

[dchacke]

I self-host Plausible CE and would like to sign in with a passkey. Plausible currently supports passwords with optional TOTP. Passkeys are phishing-resistant, faster to use, and supported by all major browsers and password managers.

I would like to implement this feature and open a pull request, but first want to check whether you would accept it and how you would like it to work.

Proposed approach

• Use wax_ for WebAuthn verification.
• Add a user_passkeys table (credential ID, public key, sign count, name, timestamps).
• Settings → Security: add, name and remove passkeys.
• Login page: a “Sign in with a passkey” option, with browser autofill where supported.
• A passkey sign-in counts as two-factor authentication and skips the TOTP step.
• Optional passwordless accounts: users with at least one passkey can remove their password. The last passkey cannot be removed while the account has no password, and password reset by email remains available for recovery.
• Passwords and TOTP continue to work unchanged for everyone else.
• The feature works the same in CE and on plausible.io.

Questions

1. Would you merge a contribution along these lines?
2. Are you open to letting users remove their password, or would you prefer to start with passkeys alongside passwords only? Letting users remove passwords should be more secure because it removes an attack vector.
3. Do you have preferences regarding the library or the UI flow?

Claude wrote this text for me; I reviewed and edited it.