Passkey on new domain

[jacoplane]

I created a passkey for a workers.dev domain, then I added the site to a different domain. But there's no way to use the workers.dev passkey on the new domain, right? Am I missing something? Email isn't configured for this site, so magic login doesn't work.

[Vituartzz]

Right, it can't. A passkey is bound to the domain it was created on (the WebAuthn RP ID), so the workers.dev one will never be offered on the new domain. The auth guide says the same under Troubleshooting → "Passkey authentication failed": "Register a new passkey for each domain."

The catch is that adding a passkey requires a session on the new domain. Without email there are still two ways to get one without touching the database:

1. Sign in once through a login provider (no email needed).

• Configure GitHub, Google or Microsoft with the env vars from the auth guide, with the callback on the new domain, e.g. https://your-new-domain/_emdash/api/auth/oauth/github/callback.
• EmDash links a provider login to your existing user when the provider returns the same verified email you entered in the setup wizard.
• Once you're signed in, go to account settings → Add passkey. It's now registered for the new domain, and you can remove the provider afterwards if you don't want it.

2. Configure an email provider (see Email Setup), use Sign in with email on the login page to get a magic link, then add the passkey.

Only if neither is possible do you need the guide's last resort: "If you're the only admin and email isn't configured, you'll need to reset your site's authentication through the database."

Once you're back in, register passkeys on two devices and keep a provider or email configured as a fallback, so the next domain move doesn't lock you out again.

[jacoplane]

Yeah I ended up just configuring email:

1. Verified a sending domain with Cloudflare Email Sending.
2. Added EmDash’s cloudflareEmail() provider to the site configuration and configured the Wrangler send_email binding for the verified sender.
3. Deployed the Worker to Cloudflare.
4. In the production EmDash admin, activated Cloudflare Email under Extensions, then selected it under Settings → Email.
5. Requested a magic login link for my existing admin email. After signing in on the production domain, I added a new passkey in account settings.

[marks-zyz]

One more route, for the case where you can still sign in on the workers.dev address and have neither a login provider nor email configured: set a password for your own account while you are signed in there, then use it on the new domain.

That is what emdash-admin-login-classic does (a small admin-only package, MIT; we are its authors). After installing it, open My access in the admin and set a password, no email involved. Password sign-in does not depend on the WebAuthn RP ID, so it works on whatever domain serves the site. It needs one Worker secret (see its README) and it is an add-on, not core: the two supported routes in the comment above remain the way to go if you would rather not install anything.

Details: #4008

Written with AI assistance (Claude Code).