Reduce Signup Friction with Federated Identity

▶ Watch (1:50)

Identity federation lets users sign up with a single click using a trusted provider like Google. The provider already verified the email, so you skip email verification loops. Google recommends the “federate then upgrade” pattern: create the account instantly via federation, then prompt the user to create a passkey. For sites that still use forms, set correct autocomplete values like new-password and email. Autofill serves as a gateway for newer features like the email verification protocol and conditional sign-in UI.

Verify User Attributes Without Contact Switching

▶ Watch (5:00)

Email OTPs and magic links force users to leave your app and check their inbox. The email verification protocol eliminates that friction. It is a three-way handshake between the email provider, the browser, and a specialized issuer. The issuer holds a first-party authentication cookie, signs a token, and passes it back. Your site annotates the email input with autocomplete="email" and n1s property, then listens for the emailverified event. For other attributes like age or legal name, use the digital credentials API. That API connects your site with a mobile wallet that holds a cryptographically signed credential from a trusted issuer like a government agency.

Passkey Creation and Sign-In with Immediate UI

▶ Watch (11:19)

Chrome 148 introduced immediate UI mode. When a user lands on your site, the browser checks for available credentials and shows a unified list of passkeys and saved passwords. If none exist, the browser returns an error without showing a UI. For new users, call getClientCapabilities to check for a platform authenticator, then call create with authenticatorAttachment: "platform". For existing users, use conditional create with mediation: "conditional". Adidas adopted conditional create and saw an 8% uplift in passkey creations. Pixiv added a security confirmation screen recommending passkeys and boosted adoption by 6% among new users.

Account Recovery and Cross-Device Sync

▶ Watch (18:54)

Passkeys can be synced and end-to-end encrypted by providers like Google Password Manager. If a user loses a device, they sign into their Google account on new hardware, enter their screen lock or manager PIN, and access synced passkeys. If all passkey-enabled devices are lost, fall back to user-verified attributes. Use the federated account that was used during signup, or verify the email address via the email verification protocol. The signal API keeps credential lists in sync: call signalUnknownCredential when a sign-in attempt uses a deleted passkey, and signalAllAcceptedCredentials after sign-ins or passkey edits.

Notable Quotes

Pass keys are an easier and more secure alternative to passwords and OTPs and are fishing resistant. Nina Satragno · ▶ Watch (11:36)

The email verification protocol allows your web application to obtain a verified email address without sending an email at all. Natalia Markoborodova · ▶ Watch (6:41)

Adidas implemented conditional create and saw an 8% uplift in pass key creations. Nina Satragno · ▶ Watch (13:55)

Pixive added a security confirmation screen recommending Pasis as a faster, more secure way to log in. Nina Satragno · ▶ Watch (14:18)

We recommend the pattern federate then upgrade. Natalia Markoborodova · ▶ Watch (3:11)

Key Takeaways

  • Use identity federation to eliminate signup forms and pre-verify user data.
  • Implement passkeys with conditional create to silently boost adoption.
  • Keep passkey lists in sync across devices using the signal API.