Cloudflare Access adds passkey sign-in, no more one-time PINs
Users can now log into Access-protected apps and the App Launcher with a passkey instead of an email OTP or a configured identity provider.
Cloudflare shipped passkey sign-in for Access on 6 November. Users can now authenticate to Access-protected applications and the App Launcher with a passkey stored on their device, a security key, or a password manager, instead of entering a one-time PIN emailed to them or going through a configured identity provider.
Enrolment happens once: a user verifies their identity through an existing login method, then adds a passkey from “Manage passkeys” on the Access login page. After that, they can select “Sign in with a passkey” without even entering an email address first, since supported browsers can surface saved passkeys directly. Admins choose which applications accept passkeys and can revoke a user’s registered passkeys from the dashboard.
Why it matters: email OTP is the weak link in a lot of Zero Trust setups, it depends on the user’s inbox staying uncompromised and on them not getting phished into typing the code somewhere else. Passkeys are bound to the origin, so this closes that gap without requiring every team to stand up a full identity provider just to get phishing-resistant login.
The caveat: it’s opt-in per application, so existing Access apps keep using whatever login method they already have until an admin turns passkeys on.