I'm building a mobile app and need passkeys plus account recovery, what’s the best approach?

A solid pattern for a mobile app is:

1) Use passkeys as the primary sign-in method

Passkeys are great for mobile because they’re:

• phishing-resistant
• fast to use
• synced across a user’s devices via platform providers
• easier than passwords

Recommended setup

• Support WebAuthn / passkeys for registration and login.
• Use the platform APIs on mobile:
  • iOS: AuthenticationServices / passkeys
  • Android: Credential Manager / passkeys
• Back your server with a standard WebAuthn library and store:
  • credential ID
  • public key
  • sign counter / related metadata
  • user handle / account mapping

2) Design recovery as a separate, high-trust path

Passkeys are excellent for normal sign-in, but recovery needs special care because losing all passkeys can lock users out.

Best recovery options, in order of strength:

A. Another passkey on another device

Encourage users to register multiple passkeys during setup:

• phone
• tablet
• laptop
• another trusted device

This is the easiest recovery path if one device is lost.

B. Recovery code / backup code

Give users a set of single-use recovery codes at enrollment.

• Show them once
• Force them to store securely
• Require one code plus step-up verification before resetting credentials

This is simple and effective if implemented carefully.

C. Verified email + step-up flow

Email can help recover accounts, but it should not be the only factor if you care about security. Use it to:

• notify users of recovery attempts
• send a recovery link
• require an additional check, such as:
  • prior device approval
  • recovery code
  • support review for high-risk cases

D. Identity verification / support fallback

For higher-risk apps, have a manual recovery path:

• government ID check
• selfie/liveness
• support ticket with risk controls

Use this only when necessary, because it adds friction.

3) A practical “best approach” architecture

If you want a robust default design:

Enrollment

1. User signs up with email or phone.
2. Create passkey immediately.
3. Encourage adding a second passkey.
4. Generate recovery codes.
5. Verify email/phone for notifications, not as primary auth.

Login

1. Offer passkey first.
2. If unavailable, allow recovery options.
3. After recovery, require the user to add a new passkey before returning to normal access.

Recovery

1. User starts recovery from a trusted channel.
2. Verify via:
   • recovery code, or
   • existing trusted device approval, or
   • support/identity verification for edge cases
3. Suspend or replace old credentials.
4. Enroll a new passkey.
5. Notify all other devices/emails of the change.

4) Important security recommendations

• Don’t rely on SMS as the primary recovery method if you can avoid it.
• Treat passwordless recovery as a risk-sensitive workflow, not a simple “forgot password” equivalent.
• Add rate limiting, device/IP anomaly detection, and recovery throttling.
• Notify users about:
  • new passkey enrollment
  • recovery events
  • credential removal
• Allow users to view and manage trusted devices/passkeys.

5) Best UX pattern

A user-friendly flow is:

• “Sign in with passkey”
• “Add another passkey for backup”
• “Download recovery codes”
• “If you lose access, recover with code or trusted device”

This gives strong security without making recovery painful.

6) If you want the simplest secure version

If you need a minimum viable but solid setup:

• Passkeys for login
• Recovery codes as the backup
• Email notifications for recovery events
• Require a new passkey after recovery

If you want, I can also sketch:

1. a mobile app auth flow diagram,
2. a database schema for passkeys + recovery, or
3. a recommended backend API design for this.