"Supabase Passkey Login in Flutter: The Complete Guide"
"Add Supabase passkey login to Flutter: enable WebAuthn, register passkeys, sign in with Face ID, and manage devices — with beta caveats."
Passwords are the worst part of every app you ship. Users forget them, reuse them, and get phished through them — and you get to build the reset flow, the breach notifications, and the support tickets. Supabase passkey login replaces all of that with the biometric sensor already in your user's pocket: Face ID, fingerprint, or Windows Hello becomes the credential, backed by the WebAuthn standard and managed through Supabase Auth. In this guide you'll enable passkeys in the Supabase dashboard, register a passkey for a signed-in user, sign in passwordlessly with it, and manage the user's passkey list — all in Flutter with supabase_flutter 2.18.x. Beta heads-up: Supabase passkeys are in beta and the client API is explicitly marked experimental — method names and behavior may change. Everything below reflects the documented flow as of October 2026; pin your supabase_flutter version and re-check the package docs before shipping. Last updated: October 3, 2026 What you'll learn What passkeys/WebAuthn are and why they beat passwords + OTPs How to enable passkeys in the Supabase dashboard (relying party setup) Registering a passkey for a signed-in user in Flutter Signing in with a passkey — no password, no OTP Listing, renaming, and deleting a user's passkeys The beta caveats: experimental API, relying party ID rules, localhost limits Supabase Passkey Login: How It Works A passkey is a WebAuthn credential: a public/private keypair where the private key never leaves the device and the public key is stored by Supabase Auth. At sign-in, Supabase sends a challenge, the device signs it after a biometric check, and Supabase verifies the signature. Phishing is structurally impossible — the credential is bound to your app's domain and can't be typed…