Facebook Engineering


Meta has developed a novel approach to enable passkey authentication on devices without accessible displays, such as XR headsets. Instead of using QR codes, the solution leverages a companion mobile app to securely transmit authentication requests via push notifications and deep links. When a user initiates login on a Meta Quest device, the headset generates a FIDO URL containing the authentication payload and sends it through the Meta Horizon app's authenticated push channel. The user receives a notification on their phone, taps it to approve, and the standard WebAuthn hybrid transport flow completes over Bluetooth. This implementation maintains all security requirements while enabling passwordless authentication for screenless devices, potentially opening the door for broader passkey adoption across IoT devices, wearables, and industrial hardware.

No Display? No Problem: Cross-Device Passkey Authentication for XR Devices

Our Solution: Using a Companion App for Secure Message Transport