Passkeys on aviwebsquad.in: roadmap after our 2FA guide
Short answer: Public readers do not need passkeys on aviwebsquad.in yet—but admin accounts will, building on 2FA done right and the detailed passkeys implementation checklist.
Current auth surface
- Fortify handles login, 2FA TOTP for dashboard users
- Sanctum tokens for MCP—separate threat model (MCP security)
Passkey phase plan
| Phase | Scope |
|---|---|
| 1 | Enable WebAuthn for Filament admin login |
| 2 | Recovery codes + passkey registration UX in Svelte settings |
| 3 | Optional passkeys for newsletter admins |
Technical notes
- HTTPS required (already on prod)
localhostRP ID for Sail dev- Store credentials in
webauthn_credentialstable per Fortify docs
Why not rush?
Passkeys solve phishing-resistant admin login—more valuable than reader comments auth.
FAQ
SMS 2FA still?
Disable for admins when passkeys land—keep SMS off entirely per earlier guide.
AI + auth?
Unrelated—do not let MCP tokens impersonate browser sessions.
Privacy policy update?
Mention WebAuthn device storage in LLMs and privacy policy style docs if user-facing.
Maintenance note (Sep 2026)
Re-validated internal links and examples against the live aviwebsquad.in CMS after the Hostinger migration; guidance in this article still matches production.