WebAuthn Level 3: What CIAM Teams Should Ship
Updated 2026-08-19 · 10 min read · By @guptadeepak
Key takeaways
- Level 3 does not add phishing resistance. Level 2 already had that. It expands what a passkey can do.
- PRF derives encryption keys from a passkey. Recovery design is mandatory before you encrypt user data with it.
- Related Origin Requests let one passkey span listed domains via /.well-known/webauthn.
- Conditional create is the enrollment lever. Signal methods stop ghost credentials in password managers.
- Detect with getClientCapabilities(). Do not hard-code a browser matrix.
On 20 July 2026, W3C proposed advancing Web Authentication Level 3 to Recommendation. The working draft has been in motion since 2021. Browsers did not wait.
This page is the CIAM cut of that spec. The longer protocol walkthrough is on the apex: WebAuthn Level 3: What's New in the Passkey Standard. The mechanics of registration and assertion remain in WebAuthn explained.
What to implement, in order
getClientCapabilities()so you stop guessing at Safari vs Chrome vs the password manager in between.- Conditional create so existing password users pick up a passkey during autofill. This is the adoption lever. Apple and Chrome both ship it.
- Signal methods so a credential you deleted server-side disappears from the provider list.
- Related Origin Requests if you run more than one registrable domain for the same account system. Host
/.well-known/webauthnon the RP ID. - PRF only after recovery is designed. Tim Cappalli's February 2026 warning still applies: a deleted passkey that was also the encryption root is silent, permanent data loss.
How this scores vendors
Protocol support is a boolean. Orchestration is not. A vendor that "has passkeys" but ships a generic WebAuthn modal will stall at 5–10% adoption. Device-aware prompting, conditional UI, and recovery are the axes on the 2026 passkey orchestration ranking.
MojoAuth and Stytch still lead that ranking as passwordless-native products. Descope is the orchestration pick, not the passkey pick. Auth0 has the protocol and a weak default UI. Cognito now has passkeys in Managed Login. Entra External ID is the Microsoft-shop path; workforce Entra ID is a different product, covered in Okta CIAM vs Auth0 vs Workforce as the same class of naming trap.
What not to do
Do not encrypt chat backups or documents with PRF and no escrow. Do not list every domain in the related-origins file. Do not treat Level 3 as a reason to pause a passkey rollout; the phishing win was already in Level 2.
Related vendors
Auth0
Auth0 remains the safest mid-market default for B2C plus B2B Enterprise SSO when developer velocity matters more than long-run TCO. Auth0 for AI Agents (GA November 2025) and Auth for MCP (GA May 2026) make it the first major CIAM with a packaged agent-identity surface. Below 50k MAU it is still hard to beat. Above 500k MAU, cost and Actions-driven lock-in make FusionAuth, Cognito, or Stytch (Twilio) plus a passkey orchestrator the more honest shortlist.
Clerk
Clerk is the default for native Next.js and Node.js apps under 100k MAU. Drop-in UI is the win. It is not an enterprise CIAM: federation long tail, Java/.NET, FedRAMP, and ISO 27001 are missing or thin. Do not put Clerk on an RFP that needs the rest of the enterprise stack. For that job use Auth0, WorkOS, or SSOJet. For passwordless-native, use MojoAuth or Stytch.
Corbado
Corbado is the deepest passkey-specialist orchestration layer in 2026, focused exclusively on driving passkey adoption on top of any underlying CIAM, with adoption analytics, A/B testing, and recovery-flow tooling that no full-platform vendor ships. For teams running Auth0 / Cognito / Keycloak who want to fix passkey adoption without changing primary CIAM, Corbado is the singular pick alongside Authsignal. Not a full CIAM, pick one of those first if greenfield.
Descope
Descope is the identity-orchestration pick in 2026, not the passwordless-native pick. Flows is the strongest visual auth designer in this index. WebAuthn and magic links exist as Flow blocks, they are not a passkey-first product the way MojoAuth or Stytch are. Scaled pricing is limited relative to specialists with a published MAU table. Pick Descope to author journeys. Pick MojoAuth or Stytch to enroll passkeys. Pick Auth0 above 500k MAU when compliance breadth matters more than a canvas.
Hanko
Hanko is the open-source passkey-first CIAM in 2026. Orchestration quality sits with Stytch and MojoAuth, not with Descope. Descope is a journey builder. Hanko is a passkey product with AGPL self-host and EU residency by default. Use it when adoption is the goal and B2B Enterprise SSO is not. For B2B SaaS or FedRAMP-shaped workloads, the narrow scope shows.
Stytch
Stytch is the strongest passkey-first CIAM in 2026 by orchestration quality, not raw feature count. Twilio acquired it on October 30, 2025; the product runs as a Twilio subsidiary with its own API surface, SDK family, and pricing, distinct from Twilio Verify. Post-acquisition the platform combines Stytch's modern auth with Twilio's communications infrastructure, repositioning it as a credible Auth0 alternative for developer-focused teams. Below 500k MAU the case is strong for both B2C and B2B SaaS; beyond that, gaps on FedRAMP, FGA, and adaptive MFA depth narrow it.
Where to next
FAQ
- Is WebAuthn Level 3 final?
- Not yet. W3C proposed it as a Recommendation on 20 July 2026 after a Candidate Recommendation Snapshot on 26 May 2026. Browsers already shipped large pieces. Treat it as late-stage, not as law.
- Does Level 3 make passkeys safer against phishing?
- No. Origin-bound public-key credentials already were. Level 3 adds PRF encryption-key derivation, related origins, list sync, feature detection, JSON helpers, and automatic enrollment.
- Should CIAM vendors expose PRF to relying parties?
- Only with a recovery path that survives a deleted passkey: extra authenticators, a recovery key, or escrow. Using PRF to unlock a vault that already has other unlock methods is safer than using it as the sole key for backups.
- What should I ask a CIAM vendor in 2026?
- Do you support conditional create, Signal API, related origins, and getClientCapabilities in generally available code? How do you recover a user who deleted the PRF-backed credential? Protocol support without orchestration is table stakes.
Sources
- W3C: Proposed Advancement of Web Authentication Level 3 (20 July 2026)
- W3C WebAuthn Level 3 Candidate Recommendation Snapshot (26 May 2026)
- CIAM Compass / apex essay: WebAuthn Level 3: What's New in the Passkey Standard