Passwordless sign-in with Face ID, Touch ID and Windows Hello: passkeys for your customers.
Tested on 2 buildsUpdated Nov 3, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Passkey Login: Passwordless sign-in with Face ID, Touch ID and Windows Hello: passkeys for your customers1 of 7
What it does
Passkey Login adds passwordless sign-in to CS-Cart and Multi-Vendor. Customers add a passkey on the new Passkeys page of their account and from then on sign in with Face ID, Touch ID, Windows Hello, an Android screen lock or a security key: one button under the sign-in form, or the passkey the browser offers in the e-mail field. Several passkeys per account, each with a name. Passwords keep working, so nobody is locked out.
How it works
Install and switch it on
The button appears under the storefront sign-in form and a Passkeys link in the account menu. The add-on runs the WebAuthn ceremonies itself (ES256 and RS256, user verification, single-use challenges, origin and domain checks, signature counter against cloned keys); no external service or API key. Administrators and vendors can use passkeys in the panel too (setting). Upgrade to Login Security: 2FA & Passkeys at any time: passkeys move over.
Features
"Sign in with a passkey" under the storefront sign-in form, in the pop-up and on the sign-in page
Passkey autofill: the browser offers the passkey in the e-mail field (WebAuthn conditional UI)
Passkeys page in the customer account: add, name and remove several passkeys
Face ID, Touch ID, Windows Hello, Android, iCloud Keychain and Google Password Manager passkeys, security keys
Server-side WebAuthn checks: challenge, origin, domain, user verification, signature, counter
Passwords keep working: no lock-out when a phone is lost
Optional passkey sign-in for administrators and vendor administrators
Admin overview: users with passkeys, sign-ins and refusals of the last 24 hours, passkey log
Remove the passkeys of a user from the admin (e.g. a lost device), with an e-mail to the user
Moves up to Login Security: 2FA & Passkeys: passkeys are handed over automatically
No external service, no API keys; full page cache friendly; CS-Cart, CS-Cart Ultimate and Multi-Vendor 4.17.2 to 4.21
What you get
Package
kv_passkey_login-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Supported
Supported
Supported
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Requirements
Core changes
None. Hooks and template overrides only
1.0.0
Nov 3, 2026
Latest
Added 6
Passwordless sign-in with passkeys on the storefront: button under the sign-in forms and passkey autofill in the e-mail field.
Passkeys page in the customer account (add, name, remove; several per account).
Optional passkey sign-in for administrators and vendor administrators.
Admin overview, passkey log, remove passkeys of a user, profile tab.
Steps back while Login Security: 2FA & Passkeys is active and hands its passkeys over automatically.
Domain-bound license check and self-healing upgrades.
Do customers still need a password?
Yes, the account keeps its password; a passkey is an extra, faster way in. Losing a phone never locks anyone out.
Which devices work?
Every current browser with passkeys: Safari (iPhone, iPad, Mac with Face ID or Touch ID), Chrome and Edge (Windows Hello, Android, Google Password Manager), Firefox, and FIDO2 security keys. Older browsers do not see the button.
Can a customer use the passkey on another device?
Synced passkeys (iCloud Keychain, Google Password Manager) appear on the customer's other devices automatically. Browsers can also use a phone nearby by QR code. Otherwise add a passkey on each device.
Does it change the checkout?
No. The button is also on the sign-in step of the checkout; guests check out as before.
What happens when I install Login Security: 2FA & Passkeys?
Passkey Login steps back while the full product is active: no second button and no own pages. On the first admin page its passkeys are handed over (same data), so customers keep signing in with them through the full product. A note on Customers > Passkey sign-in shows the result and can hand them over again. Switch the full product off and Passkey Login is back with its own passkeys.
Does it work with the full page cache of CS-Cart 4.21?
Yes. The button is the same for every visitor; sign-in runs through JavaScript POST requests.
Is any data sent to a third party?
No. Passkeys are verified on your server; the store keeps only the public key, the name and dates.
Abandoned Cart Recovery Pro
