Multi-factor authentication is becoming the gold standard method for verifying a user’s identity on the internet and the technology is evolving to make way for more advanced and seamless authentication that can streamline the checkout process for eCommerce stores. With this new authentication technology, users no longer need to memorize or manage long-from passwords; passkeys use your device to confirm it’s really you.
What is a Passkey?
A passkey is a secure sign-in method that doesn’t require a password. Passkeys are encrypted on your device and/or password manager and can be synced between accounts across all your devices like a traditional password. When a user creates a new passkey, a public key is stored by the site that is linked to an encrypted private key on your device, and the two must be linked together to authenticate you.
Passkeys are now available on all browsers and compatible with FIDO authentication standards, quickly becoming the safest, most reliable option for users looking to protect their data and many online retailers are using them to improve the customer experience and increase eCommerce revenue.
How Implementing Passkeys Improves eCommerce CX
Data security continues to evolve as fraud becomes even more sophisticated and difficult to detect. As the internet moves forward, users are looking for even more ways to protect themselves, which will likely lead us down the path to a future without passwords.
Passkeys are safer, as your method of unlocking your device is the only verification needed to verify you. This is usually accomplished with a PIN, pattern, or biometric verification and can thus only be successful when the user in question is who they claim to be. This advanced verification method can help users resist phishing attacks and protects them from data breaches. Since your public key isn’t useful in authenticating you without the completed pair, even if an attacker got their hands on the public key, they wouldn’t be able to use it.
Beyond that, users don’t like managing hundreds of passwords. This can add friction to the customer journey and hinder the experience of using a site. When implemented at checkout, passkeys can help retailers collect customer data without the hassle of signing-in to a customer account or recovering a forgotten password. Retailers are starting to adopt passkey technology so they can continue to protect user data and improve the customer experience.
Exploring Two Types of Passkeys
There are two types of passkeys you may interact with as they become more widely used: synced and device-bound.
Synced
Synced passkeys are more commonly used and can be accessed through standardized software that is likely already available within your operating system. Synced passkeys are available across all devices you have access to through a credential manager, such as Google Password Manager or Apple Passwords. Your passkeys are available to you through your access to the credential manager, not your device, so passkeys can be accessed regardless of where you are or what device you’re using.
Device-Bound
Device-bound passkeys are only available on the device where they’re stored. They are accessed using an external hardware device known as a security key that cannot leave the device. The only way to access the passkey is with a physical security key that can be accessed on any device it’s connected to, making them extremely secure and more commonly used in high-security environments.
Sometimes the default credential management software available on your device works this way. The Windows operating system, for example, requires Windows users to install a browser extension to sync passkeys across devices, or to simply use the credential management software within the browser itself if you prefer cross-device verification.
How to Set Up Passkeys on Your Site
Depending on where you host your website, passkeys might be available to you already through your eCommerce platform’s existing features. If your online store is hosted on Shopify Plus, for example, you already have access to this technology, and it could be as simple as allowing your customers to sign in with their Shop account. This allows your customers to auto-populate their shipping information and payment details upon verification through their passkey, which can reduce checkout friction and keep customer data secure. If you’re looking for help with integrating passkeys into your Shopify Plus store, the virid team can help.
If you’re using a custom-built site and looking to implement passkey sign-in capability into your checkout flow, you will need to integrate WebAuthn, the technology behind passkeys into your store. This can be done using authentication APIs through third-party tools such as Authsignal or Auth0.
Final Takeaways
Regardless of how you approach data security on your eCommerce site, you’ll need to keep up with shifts in technology. The retailers that evolve quickly will get ahead.
Virid’s Unified Commerce Solution combines our award-winning eCommerce platform, marketAgility, with dedicated client support and deep commerce expertise to help you unlock your next phase of growth. We help retailers stay competitive by adapting to shifting customer expectations, advising them on the newest technological advancements, and helping them shape their long-term commerce strategy.
