Turning on Authelia passkey login does not, by itself, document a change that removes TOTP. Passkey login is a separate WebAuthn option and counts as one factor; when a request requires multi-factor authentication, Authelia prompts for the user’s password by default. TOTP remains the documented default second-factor method. An empty diff cannot be diagnosed without the compared files, Authelia release, and effective runtime configuration, so check those before assuming a setting was changed.
Why passkey login and TOTP can coexist
Authelia treats passkey login and the selected second-factor method as separate configuration concerns. The WebAuthn setting webauthn.enable_passkey_login is disabled by default. When enabled, passkey login “only counts as a single factor.” For requests requiring multi-factor authentication, Authelia prompts for the user’s password by default. Authelia WebAuthn configuration
As an Amazon Associate I earn from qualifying purchases.
The miscellaneous configuration reference lists default_2fa_method as totp by default. Authelia documents an automatic change to a user’s second-factor method in the specific case where webauthn is configured as the default and TOTP is disabled. It does not say that enabling passkey login alone disables TOTP. Authelia miscellaneous configuration
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What an empty diff does—and does not—tell you
A diff shows changes between the particular revisions and paths you compared; it does not necessarily show every input used by the running Authelia process. The available documentation does not identify the cause of your empty diff. Establish what was compared, then inspect the effective configuration rather than treating the empty result as proof that a setting is absent or active.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Confirm the comparison. Check the repository revisions, filenames, and paths on both sides. Make sure you are comparing the configuration actually deployed, not a sample file or a different environment.
- Check the value and defaults. Determine whether the desired value is already present or whether the release’s default produces the behavior you expected. Passkey login defaults to disabled; the documented default second-factor method is TOTP.
- Inspect runtime inputs. Authelia maps the passkey-login option to an environment variable. Check every configuration file or directory the process loads, any configuration filters, and the deployment environment, including variables passed by the service or container. Authelia environment variables Authelia configuration introduction
- Validate against the installed release. Authelia’s schema guidance uses a versioned schema corresponding to the release;
latestrefers to the latest release andnextto master. Use the schema matching your deployed version rather than assuming current rolling documentation describes an older installation. Authelia configuration schema guidance
Passkey hardening settings: recommendation versus defaults
Authelia’s recommendation page presents this profile as compliant with its stated NIST recommendations. That is the page’s characterization of this configuration—not a blanket claim that every passkey setup is NIST-compliant.
webauthn:
enable_passkey_login: true
attestation_conveyance_preference: 'direct'
filtering:
prohibit_backup_eligibility: true
metadata:
enabled: true
validate_trust_anchor: true
validate_entry: true
validate_status: true
validate_entry_permit_zero_aaguid: falseThe configuration reference lists passkey login and metadata as disabled by default, so applying the recommended profile changes more than the login toggle. prohibit_backup_eligibility prevents registration of authenticators that can export credentials, which may rule out synchronized credentials. Metadata validation uses a downloaded metadata-service blob and requires about 5 MB of configured storage-backend data, according to Authelia; this is a configuration requirement, not a general storage estimate for all deployments. Review authenticator compatibility before enforcing these restrictions. Authelia passkey recommendations Authelia WebAuthn configuration
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What TOTP fallback means in practice
Authelia implements TOTP (Time-Based One-Time Password) under RFC 6238, an extension of HOTP (RFC 4226). Its documented example uses SHA-1, six digits, a 30-second period, skew of one, and a generated 32-byte secret. The defaults favor compatibility because many authenticator apps support only six digits and SHA-1. Authelia TOTP configuration
Recommended Free Tools
The period sets code rotation; skew controls how many adjacent time windows are accepted. Authelia gives the effective validity-window formula as period + (period * skew * 2). With a 30-second period and skew of one, that is 90 seconds. Authelia recommends retaining a 30-second period and notes that accurate client and server clocks matter for validation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Algorithm, digits, and period settings are captured for newly registered keys, with this behavior documented as taking effect from version 4.33.0 onward. Authelia also says TOTP secrets are encrypted in the database in version 4.33.0 and above. Check the release before relying on either version-specific detail. Authelia TOTP configuration
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose authenticators around your policy
Authelia documents WebAuthn security keys and cross-platform authenticators such as physical security keys, but the configuration options do not establish universal compatibility across devices. Assess the factors that affect your deployment:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Whether the passkey is used for passkey login or as a second factor in an MFA flow.
- Whether the credential is platform-based, held on a cross-platform hardware authenticator, or synchronized.
- Whether your policy permits backup-eligible credentials.
- Whether attestation and metadata validation are enabled and appropriate for your users’ authenticators.
- Compatibility with the browsers, operating systems, and authenticators your users actually use.
A physical security key is an optional WebAuthn path; passkey use does not inherently require buying one. Authelia WebAuthn configuration
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
