Partner material

W3C and OpenID Foundation Publish Joint Proposal to Standardize Passkey Migration Across Devices

26 September 2026

On 21 August 2025, the W3C Web Application Security Working Group published a First Public Working Draft specifying a well-known URL for relying party (RP) passkey endpoints. This proposal, "A Well-Known URL for Relying Party Passkey Endpoints," aims to standardize the way WebAuthn relying parties can host endpoints for passkey creation and management, making them discoverable by clients and credential managers.

The draft defines a well-known URL, https://<relying-party-identifier>/.well-known/passkey-endpoints, that relying parties must host with a JSON document. This document enables a browser to discover the endpoint for that relying party's passkey creation and management services.

Currently, RP passkey endpoints in WebAuthn remain static and hardcoded, making it difficult to advertise that a relying party supports passkeys and where users can go to create and manage them. The proposed standard could streamline and unify these discovery mechanisms.

The W3C draft is closely linked to an ongoing discussion about how to handle Relying Party Identifier (RP ID) migration scenarios, such as when a service changes from one RP ID to another, like the recent migration from Twitter.com to X.com. The W3C WebAuthn repository issue #2350, "Consider RP ID migration use cases," frames the problem and sketches out an initial set of solutions.

Firstly, the issue proposes "open[ing] up conditional create" — a mechanism that would allow a relying party to "upsert" an existing credential onto the new RP ID. This would involve detecting an existing credential via an "extension" and then re-establishing it on the new RP ID.

A second option is to add a new signal within the WebAuthn Attestation that would tell the WebAuthn Client that a registration request needs to "re-fingerprint" an existing credential to the new RP ID, rather than creating an entirely new credential.

The third and final path proposes relying on the existing WebAuthn modal registration flow. Users would register the new service manually, though they would see UX cues that reassure them the new RP ID is trusted.

Those commenting on the issue have already noted that the problem may already be addressable with a combination of Related Origin Requests, Conditional Create, and the Signal API.

Significantly, one commenter stressed the risks of defining "re-delegation" in Passkey infrastructure and the desire to define a UX that makes it clear the credential is not being replaced. The goal should be making it easier for users to register a new credential for a closely related origin, rather than replacing or reusing the existing one.

While the W3C's focus has been on standardizing and simplifying the passkey registration process, the OpenID Foundation's most recent work on account porting approaches the credential migration problem from a different angle.

OpenID Connect Account Porting

The OpenID Connect Account Porting spec outlines the protocols, configuration, and schema required to support a user transitioning their account from one OpenID Provider (OIDP) to another. This is another common source of friction for users and relying parties alike. When a user switches to a new identity provider, recognizing and verifying this switch can be technically challenging, requiring complex configuration and disrupting a user's smooth transition.

With account porting, OpenID Connect Providers can achieve scalable and secure portability of OpenID Connect Relying Parties across Issuers. As the OpenID Foundation explains, "The main benefit for users is the ability to change OpenID Providers without causing disruption in existing service."

For Relying Parties, automated Porting reduces operational costs by minimizing support calls and workarounds. By establishing and formalizing this process, the OpenID Connect Account Porting specification outperforms other possible approaches, offering a robust and flexible solution.

Finally, it's worth noting that these standardization efforts are happening in the context of broader, more recent work around synced passkeys and cross-device authentication. The FIDO Alliance's Emerging Practices for Synced-Passkey Deployment, released in January 2024, highlights how passkey use is expanding to multiple devices, with credentials synced across the cloud. While this approach reduces friction for accounts with lost or inaccessible passkeys, the FIDO notes the continued need for alternative account recovery methods alongside passkey capabilities.

Likewise, the success of Synced-Passkey Deployment is dependent on multiple communication protocols. It assumes a stable connection for tunneling data, and in the absence of that, requires QR codes, camera access, Bluetooth and Wi-Fi capabilities. What this shows is that, even when relying parties' needs are met, users will still need robust hardware and high-level security permissions to access their synced credentials.

Though migration is an irregular occurrence, these standardization efforts have real implications for user experience and adoption of passkey-enabled services. By formalizing how relying parties host endpoints and make them discoverable, as well as how users transition accounts and credentials from one service to another, WebAuthn and OpenID Connect can become simpler and more flexible.

Even as they advance, there are still open questions worth watching. How granular will the mapping between old and new credentials end up being? Will there be support and direction for re-binding credentials on individual accounts? When should a migration mean reconfirming or replacing credentials altogether, versus simply creating new ones?

The W3C draft, like all published working drafts, still has to advance through the organization's standardization process before earning the status of full recommendation. OpenID's published specifications similarly show a noteworthy advancement in the transition of user credentials between online services.

Given the continued growth and importance of passkeys in authentication, expect rapid development on these initiatives in the coming months.