Passkey Post

== Description ==

Passkeys are the first authentication change in twenty years that makes the secure path also the fast path. Passkey Post adds WebAuthn registration and login, keeps passwords working until you decide otherwise, and can require passkeys for administrators while leaving subscribers alone.

Recovery is printed one-time codes, generated when the first passkey is registered. Recovery by email means the account is only as strong as the mailbox, which defeats the exercise.

Credentials are stored as public keys. There is no shared secret on the server, so a database dump does not contain anything that can log anyone in.

== Screenshots ==

Numbered the way they ship in /assets/. Click any one to see it full width.

01

02

03

04

05

06

== Installation ==

• Install and activate the plugin. Your site must be served over HTTPS — WebAuthn requires it.
• Register a passkey on your own account under Users → Profile and save the recovery codes.
• Only then enable enforcement for a role, under Settings → Passkeys.

Enforce for administrators last, and only after your own passkey works. The plugin warns you about this in the interface too.

== Frequently asked questions ==

What if I lose my device?

Use a recovery code. Each is single-use, and using one prompts you to register a new passkey immediately.

Does it work with security keys?

Yes. Anything that speaks WebAuthn: platform authenticators, USB keys, phones over Bluetooth.

Can I still use a password?

Until you turn that off per role. Nothing forces the change.

== Changelog ==