Passkeys for Frappe: documentation

Passkey (WebAuthn / FIDO2) sign-in and action confirmation for Frappe and ERPNext v15 and v16. New here? Start with Install, then Configuration.

Set up and run

Install: install, upgrade, uninstall, the version matrix, and reverse-proxy / RP ID / origin requirements.
Configuration: every Passkey Settings field, its default, and the security consequence of changing it.
Operations: pre-production checks, RP ID and domain changes, backup and restore, incident response, revocation, and monitoring.
Recovery: System Manager recovery through Desk, then Administrator and account-specific console procedures when no manager can sign in.

Custom UI: build your own passkey login and management screens with the frappe.passkeys.headless JavaScript API, protect your own methods with @passkey_protected, or restyle the shipped cards.
REST API: the whitelisted endpoints (arguments, response shapes, CSRF, rate limits) for a native app or a no-JS single-page app.
Mobile apps: let a native iOS or Android app share the site’s passkeys: trusted app origins, the two well-known association files, and the endpoints.

Security model: what the app enforces, what it trusts, residual risks, and disclosure.
WebAuthn Level 3 support: which WebAuthn L3 relying-party steps and browser features the app supports, where each is handled, and which it does not support.
Why passkeys are safer: a short illustrated explainer for decision makers.
Security policy: how to report a vulnerability privately.

Changelog: what changed in each release.
Upstream proposal: a design and validation checklist for adopting passkeys in Frappe core.
Contributing: development setup, branches, tests, and releases.