Attach or detach a passkey
A passkey is an authentication credential based on the FIDO2 standard. It lets you log on using authentication methods that are supported by your device, such as fingerprint recognition, facial recognition, or a security key. Passkeys improve your account security and user experience, and significantly reduce the issues that are associated with passwords.
What is a passkey and why should you configure one?
A passkey is a new authentication method that replaces traditional passwords. You can use your device's built-in fingerprint, facial recognition, or screen lock PIN to securely and conveniently log on to your Alibaba Cloud account. Passkeys are based on the FIDO2 standard and use public key encryption. When you create a passkey, your device generates a key pair:
Private key: Stored only on your on-premises device. It is never uploaded or exposed. This key is similar to your own unique physical key.
Public key: Stored on Alibaba Cloud. This key acts as the lock.
When you log on, Alibaba Cloud uses the public key to send an authentication request to your device. Only the private key on your device, combined with your biometric data, can unlock access. The entire process requires no password entry. Your biometric information never leaves your device. This significantly improves account security.
Advantages of passkeys
Phishing protection: Each passkey is tied to a specific website. It cannot be used on a counterfeit site. This feature effectively prevents phishing attacks.
No passwords to remember: Avoids password-related risks, such as passwords being easily cracked, shared, or stored improperly.
Efficient and convenient: Biometric authentication significantly reduces logon time. It is much faster than using traditional passwords or CAPTCHAs.
What passkeys are supported for an Alibaba Cloud account?
You can add passkeys for a single Alibaba Cloud account on multiple devices. However, on a single device, you can attach only one passkey for each type of unlock method or authenticator, such as a fingerprint, face, system PIN, screen lock, or a specific security key.
Ensure that your devices and software meet the following version requirements:
Browser versions
Google Chrome: 67 or later.
Microsoft Edge: 18 or later.
Safari (macOS): 13 or later.
Safari (iOS): 14.5 or later.
Firefox: 60 or later.
Computers
Windows 10 and Windows 11 operating systems. These systems support saving passkeys locally and authenticating with Windows Hello. The recommended version for Windows 10 is 1903, and the recommended version for Windows 11 is 22H2.
macOS 13 or later. These versions support saving passkeys to iCloud Keychain for synchronization across multiple devices. Ensure that all devices meet the system version requirements. If you use a passkey on a web page opened within an app, such as an in-app browser or embedded logon page, the system version requirement is higher. macOS 13.3 or later is recommended.
You can save passkeys in browsers that meet the version requirements. Synchronization across multiple devices is supported through Google Chrome and Microsoft Edge.
Mobile devices
iOS / iPadOS (Safari):
iOS Safari 14.5 or later supports WebAuthn (browser-side).
If you use a passkey on a web page opened within an app, such as an in-app browser or embedded logon page, the system version requirement is higher. iOS 16.4 or later is recommended.
Android:
Mobile device manufacturers customize the Android system to varying degrees. As a result, phones with customized Android systems generally do not support passkeys.
If supported, devices that run Android 9 (API level 28) or later support passkeys through Credential Manager. On Android 14 or later, you can select a third-party password manager as the passkey provider in the system settings.
Other devices
Security keys that comply with the FIDO2 specification are supported. These devices can connect to your device using USB, Bluetooth, or NFC. The browser must also support WebAuthn.
Attach a passkey
Log on to the Alibaba Cloud Account Center. Go to the Security page. In the Logon method section, find Passkey Login and click Set up.
Alternatively, on the Overview page of the Account Center, find the My Account section. In the Passkey Login (New) field, click the
icon to modify the settings.Review the Passkey Login Info and click Set Up.
On the Verify Identity page, select an available identity verification method, such as Phone Number Verification, Alipay Verification, or Facial Recognition Verification.
After the verification is successful, your browser or operating system displays a window to create a passkey. Follow the prompts to create the passkey using your fingerprint, facial recognition, or PIN.
After the passkey is created, the Passkeys window appears. You can view or modify the Passkey Name for future management.
After the passkey is attached, you can use it to log on to your account.
Log on to your account using a passkey
Go to the Alibaba Cloud logon page and click the Passkey tab.
Click Log on with a passkey. Your browser prompts you to select a saved passkey.
Follow the prompts on your device to complete the verification using your fingerprint, Face ID, or device password.
After the verification is successful, you are automatically logged on to Alibaba Cloud.
For more information about other logon methods, see Step 2: Log on to an Alibaba Cloud account.
Detach a passkey
Log on to the Alibaba Cloud Account Center. On the Overview page, in the My Account section, find Passkey Login (New) and click the
icon to modify the settings.Alternatively, go to the Security page. In the Logon method section, find Passkey Login and click Set up.
In the Passkeys window, view the list of all attached passkeys. Select the passkey that you want to detach and click Delete in the Actions column. On the confirmation page, click OK.
On the Verify Identity page, select an available identity verification method, such as Phone Number Verification, Alipay Verification, or Facial Recognition Verification.
After the verification is successful, the passkey is removed from your account.
FAQ
What if I replace my device or lose the device with the attached passkey?
We recommend that you attach multiple passkeys. If you still have another device with an active passkey, you can use it to log on and detach the key from the lost device. If all your passkeys are unavailable, you can still log on using traditional methods, such as your account password or phone number. Then, you can manage your passkeys.
Are there differences between passkeys used by Alibaba Cloud accounts and Resource Access Management (RAM) users?
Yes, there are. For more information about passkeys for Resource Access Management (RAM) users, see What is a passkey? and Attach a passkey to a RAM user.
Differences |
Passkey for an Alibaba Cloud account |
Passkey for a RAM user |
Passkey purpose |
|
|
Attach or detach operation |
To perform attach or detach operations, log on to the Account Center with your Alibaba Cloud account. |
RAM users can perform attach or detach operations using the RAM logon page or the RAM console. |
Quantity limit |
You can attach multiple passkeys to a single Alibaba Cloud account across different devices. |
A RAM user can have a maximum of five passkeys. |
Supported devices |
See What passkeys are supported for an Alibaba Cloud account? |
Why can't I successfully attach or use a passkey?
Check the following items:
Unsupported environment: Ensure that your operating system and browser versions meet the requirements that are described in What passkeys are supported for an Alibaba Cloud account?
Insecure environment: Passkeys must be created and used over the HTTPS protocol. Ensure that you are accessing an official Alibaba Cloud URL that starts with
https://.RAM user: If you are a RAM user, you may need to contact the administrator of your Alibaba Cloud account to enable the "Allow RAM users to log on with passkeys" feature in the global security settings.