AuthPoint Mobile App Beta: A Modernized Experience

Passkeys for OIDC in AuthPoint is now generally available, following the Open Beta that ran from February 5th through February 19th.

What's new

AuthPoint now supports FIDO2 passkeys as an authentication method for OIDC-based resources. With this release, users can authenticate to FireCloud, Microsoft External Authentication Methods, and any OIDC application integrated through AuthPoint using passkeys, without a password.

Authentication is performed using device biometrics (Face ID, Touch ID, Windows Hello) or a device PIN to unlock the passkey, which then completes the cryptographic handshake with the application. The private key stays on the user's device and is never transmitted; AuthPoint stores and verifies the public key. This design makes passkey authentication phishing-resistant by default, meeting phishing-resistant MFA requirements found in common compliance frameworks and cyber insurance policies.

Users do not need the AuthPoint mobile app to use passkeys.

What administrators need to know

Passkey availability is controlled per OIDC resource through Zero Trust Policies in WatchGuard Cloud. You can enable passkeys for specific applications, roll out access gradually, or restrict passkey use to high-security resources while keeping other authentication options available elsewhere.

When a user authenticates with a passkey, the combination of device possession and biometric or PIN verification satisfies MFA requirements. AuthPoint treats passkey authentication as complete.

Passkey private keys are managed by the user’s device platform (Apple iCloud Keychain, Google Password Manager, or Windows WebAuthn) or by hardware security keys such as YubiKey.

Licensing

Passkeys for OIDC are included with both AuthPoint MFA and AuthPoint Total Identity Security licenses at no additional cost.

Getting started

Refer to the AuthPoint release notes and the AuthPoint Help Center for configuration steps. For questions, contact your WatchGuard Account Manager or reach out through standard support channels.

We're excited to announce that Passkeys for OIDC in AuthPoint is now available in Open Beta, running from February 5th through February 19th.

What's new

AuthPoint now supports FIDO2 passkeys for OIDC-based resources. OIDC (OpenID Connect) is a widely-used authentication protocol that allows users to sign in to multiple applications with a single identity. With this release, users can authenticate to FireCloud, Microsoft External Authentication Methods, and any OIDC applications integrated through AuthPoint using passkeys.

Here's how it works: Users use biometrics (FaceID, TouchID, Windows Hello) or a device PIN to unlock their passkey, which then handles the authentication to the application. No passwords to remember or type.

Passkeys use both public and private key cryptography, where the private key stays on the user's device and is never transmitted and the public key is stored in AuthPoint. This cryptographic design provides phishing-resistant authentication.

Organizations are facing increased requirements for phishing-resistant MFA in compliance frameworks and cyber insurance policies. Passkeys meet these requirements while simplifying the user experience.

What partners need to know

The Passkey private keys are managed by the user's device platform: Apple iCloud Keychain, Google Password Manager, Windows WebAuthn, or hardware security keys like YubiKey. AuthPoint uses the public key to verify the cryptographic signature. Users don't need the AuthPoint mobile app to use passkeys.

When a user authenticates with a passkey, they've already satisfied MFA requirements through the combination of device possession and biometric or PIN verification. AuthPoint treats passkey authentication as complete.

Administrators control passkey availability per OIDC resource through Zero Trust Policies in WatchGuard Cloud. You can roll out passkeys gradually, test specific applications, or enforce them for high-security resources while keeping other authentication options available for different use case.

Join the beta

Access it through WatchGuard Center Code, where you'll find instructions for getting started and reference materials.

We're looking for feedback on deployment scenarios, user experience, and how you're positioning this capability with customers. You can submit your feedback directly through Center Code.

Passkeys are included with both MFA and Total Identity Security licenses at no additional cost.

For technical questions during the beta, reach out through the usual support channels.

Modern identity security relies on standardized, interoperable protocols. To help you centralize control and eliminate authentication silos, we are excited to announce that AuthPoint now supports OpenID Connect (OIDC) as a new resource type, currently in Beta.

By acting as an OpenID Provider (OP), AuthPoint allows you to extend MFA and robust conditional access policies to a wider range of modern SaaS platforms and custom-built applications.

Why OIDC Matters for Your Security Posture

While SAML has long been the enterprise standard, OIDC (built on top of OAuth 2.0) is the preferred choice for modern web and mobile applications due to its lightweight JSON-based structures and better support for API-driven environments.

Joining the beta program is quick and easy. To get started, simply visit our beta management site where you will find instructions to download the new agent and begin testing.

Join the beta and share your suggestions and feedback! 
The AuthPoint beta team.