Can't use passkey on Github.com

Hey @JeroenVdb,

I'm sorry for the delayed response.

I have done some testing and I was able to recreate the same behaviour that you are seeing when using my iOS device. With that being said, you shouldn't need to use your iPhone to sign in, 1Password in your browser should be offering to fill your passkey here.

If you click on the 1Password icon in your browser toolbar do you see your Github item here with a passkey saved?

The expected flow would be when you click 'Use passkey' you will see a prompt from 1Password in the top right hand corner of your screen offering to sign you in with your passkey. Do you see this on your end?

you shouldn't need to use your iPhone to sign in, 1Password in your browser should be offering to fill your passkey here.

Unless I don't completly understand the use of passkeys I don't fully agree.

I would expect I can login with my passkey on a new/other/public computer where I don't have the 1Password extension and app available. Or am I seeing this wrong?

@JeroenVdb

Thanks for the reply, I agree that the functionality should be working. I just tested things on my own device and everything is working when signing in using a passkey with 1Password on iOS on both Chrome and Brave on my Mac.

I think what might be happening here is that you saved a passkey for two-factor authentication rather than for login. If you were using a passkey for sign in then the Github page should say "Sign in to Github" but it says "Two-factor authentication" in your screen recording.

Can you go to https://github.com/settings/security, turn off two-factor authentication, and then save a passkey for sign in 1Password using these steps: Passkeys.directory - Github

Make sure to first turn off two-factor authentication with the old passkey. The new passkey for sign in will replace the old passkey for two-factor authentication.

Let me know if that works. 🙂

-Dave

@1P_Dave you are correct. I had a passkey used for both login and MFA.

Github also enforces MFA so I guess I can't remove it but change it to using the classic TOTP.

I think what might be happening here is that you saved a passkey for two-factor authentication rather than for login. If you were using a passkey for sign in then the Github page should say "Sign in to Github" but it says "Two-factor authentication" in your screen recording.

GitHub is rather smart about that and will offer to upgrade “2FA passkeys” to “real passkeys”.

At least, that’s what happened for me (for already registered YubiKeys).

More info: https://github.blog/2023-07-12-introducing-passwordless-authentication-on-github-com/#how-to-upgrade-security-keys-to-passkeys