Passkeys & step-up TOTP
Generated from
mcp/patterns.registry.json— do not edit by hand; change the registry and runbun run patterns:build.
Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.
Category: Identity & Access · Tier: light · Risk: medium — security-critical auth factor, Redis-backed step-up gate
WebAuthn passkeys serve as a phishing-resistant first-factor sign-in credential, while TOTP is repurposed as a step-up check before sensitive actions, gated by a Redis freshness stamp.
When to use: Use passkeys to harden sign-in and step-up TOTP to re-verify identity right before a sensitive action like disabling 2FA.
Docs
Code
src/lib/server/auth/step-up.ts(GitHub · GitLab)src/lib/server/auth/factor-changes.ts(GitHub · GitLab)src/lib/components/composites/step-up-dialog/(GitHub · GitLab)
Proof
/account/security(app route, no showcase)
Machine-readable record: identity-passkeys in mcp/patterns.registry.json.