Passkeys arrive on the Stripe Dashboard
Stripe has begun rolling out passkey support for Dashboard logins, giving users an authentication option that is both faster than a password and resistant to the usual phishing and credential-theft attacks. The feature works alongside existing device authentication methods such as Touch ID, Face ID, and physical security keys, and it removes the password step entirely.
The underlying mechanism is public-key cryptography. When a user registers a passkey, two keys are generated: a public key stored with Stripe and a private key held only on the user's device. During a login attempt, Stripe's server sends a challenge to the device. The user authenticates locally — via fingerprint, facial recognition, or a hardware key — to unlock the private key, which then signs the challenge. The signed challenge is returned to Stripe, which verifies the signature and completes the login.
Because the private key never leaves the device and is never transmitted over the network, the credential is not exposed to remote attackers. Accounts remain protected even if a device is lost or stolen, since the private key remains locked behind the device's own authentication method.
Setting up a passkey
Registration is a one-time process. After logging in to the Dashboard, a user navigates to profile settings and selects "Add a passkey." The browser prompts for identity verification using any of the supported on-device methods. Once the challenge is completed, the passkey is saved to the device, and subsequent logins from that device require only a single click.
The feature is part of a broader security push at Stripe. The company has already mandated two-factor authentication for users and is working to increase adoption of phishing-resistant authentication methods. Passkeys complement those efforts by eliminating the overhead of passwords and slower multifactor flows, while providing stronger protection against credential theft.
