Agent WranglersSign-in methods
Pick who runs sign-in, keep your own user IDs, and make passkeys the first choice. Email links and provider logins each need their own care.
- Required 3
- Recommended 3
- Optional 1
Required
Keep your own user ID
RequiredGive every person your own stable user ID and map each sign-in method to it. Never key records by an email address or a provider's user ID.
Verify every passkey answer on the server
RequiredAccept a passkey sign-in only after the server checks the challenge, origin, relying party ID, user flags and signature with a maintained WebAuthn library.
Never remove the last way to sign in
RequiredLet people add and remove sign-in methods, but refuse to remove the last one. Never link a provider login to an account by email alone.
Recommended
Decide whether a provider or a library runs sign-in
RecommendedChoose a hosted identity provider or a maintained library on purpose, write down why, and never write your own password, token or protocol code.
Offer passkeys first
RecommendedOffer passkeys as the main way to sign in, through autofill. Invite people to create one right after they sign in another way.
Weigh email links before making them the only way in
RecommendedUse email links or codes as the only sign-in for low-risk accounts only. Bind each link to the browser that asked for it, and offer a passkey after the first sign-in.
Optional
Keep the password manager's passkey list current
OptionalTell the browser when a passkey stops working or a user's name changes, with the WebAuthn signal methods, so people stop picking dead passkeys.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-in-methods.