Last update:
HSID passkey FAQs
Aug 14, 2026
This FAQ provides guidance on HSID passkey behavior, including enrollment, sign-in flows, device and browser scope, shared-device scenarios, and environment isolation.
Passkey setup & login behavior
Passkey enrollment frequency
Does the passkey setup prompt appear on every login, or is it a one‑time prompt per account?
Passkey step-up behavior is configured at the tenant level, not at the individual portal level. Currently, the tenant configuration requires passkey step-up during the first three successful logins for a user account. After these initial logins are completed, users will no longer be prompted for passkey step-up.
Login experience without a passkey
If a user does not have a passkey set up, what login experience do they see?
If the user does not have a passkey:
- User enters email.
- User is prompted for password.
- Phone verification (MFA) is completed.
- Before landing on the portal dashboard, the user is prompted to create a passkey:
- The user can skip this step.
- If skipped, the user is redirected to the portal dashboard.
- On future logins, the user can continue using password + MFA.
If the user creates a passkey:
- Clicking Continue redirects them directly to the portal dashboard.
- Subsequent logins will favor passkey authentication.
Device and browser scope
Device vs browser binding
Is a passkey device-specific, browser‑specific, or OS/platform‑specific, or OS/platform‑level?
In HSID, passkeys are browser- specific by default, with optional OS/platform-level sharing if the user enables it.
Browser-specific (default behavior)
- Passkeys are initially tied to the browser where they are created.
- A passkey created in Chrome will not automatically appear in Safari or Edge.
- Each browser maintains its own WebAuthn credential store.
OS/platform-level association (optional, user-controlled)
Passkeys can be shared across devices if platform sync is enabled:
- Chrome / Android → Google account sync
- Safari / iOS / macOS → iCloud Keychain
- Edge / Windows → Microsoft account
Important clarifications:
- HSID does not sync passkeys.
- Sync happens externally via the OS or browser account.
- Users must explicitly enable credential sync.
Device-bound / hardware bound / hardware backed (contextual)
- Passkeys use WebAuthn with secure hardware (TPM / Secure Enclave) when available.
- HSID does not enforce strict single device binding.
Summary
| Scope | HSID behavior |
|---|---|
| Browser specific | Yes (default) |
| OS / platform level | Yes (user enabled sync) |
| Strictly device bound | No |
Device and account limitations
Passkey limits per user account
Is there a limit on the number of passkeys per HSID user account?
Yes. A single HSID user account can register up to 6 passkeys.
Each passkey typically corresponds to:
- A device–browser combination, or
- A synchronized platform credential (e.g., Chrome + Google account).
Limits per device or browser
Is there a limit on how many accounts or passkeys a device or browser can store?
No HSID‑ enforced limit exists.
- HSID does not track or cap how many user accounts a device or browser can hold.
- Passkeys are stored in the browser or OS credential manager.
- Any practical limits are imposed by the browser or operating system, not HSID.
Login from a new device or browser
Alternative sign-in options
What happens if a user with an existing passkey logs in from a new device or browser?
Authentication method
- HSID first checks for a local passkey.
- If no valid passkey is found:
- User is offered password + MFA login.
- User can explicitly select “Sign in with password”.
Login is always allowed.
Passkey registration requirement
Is the user required to create a new passkey for the new device or browser?
No. Passkey creation is optional.
- Users can log in using password + MFA.
- After login, users may:
- Add a new passkey via Manage Passkeys.
- Skip passkey creation entirely.
Platform- synced passkey exception
If platform sync is enabled:
- The passkey may already be available.
- Login proceeds directly using passkey.
- No password or new passkey creation is required.
Login behavior summary
| Scenario | HSID behavior |
|---|---|
| Login from new device/browser | Allowed |
| Password/MFA fallback | Yes |
| Forced passkey creation | No |
| Optional passkey setup | Yes |
| Auto‑reuse via sync | Yes (user controlled) |
Multiple accounts and shared devices
Multiple accounts on the same device
Can one device or browser store passkeys for multiple HSID accounts?
Yes.
- A single browser or device can store passkeys for multiple HSID user accounts.
- At login, the browser/OS displays a credential picker.
- The user selects the appropriate account/passkey.
Shared household scenarios
What is the expected behavior when devices are shared within a household?
Fully supported.
Example:
- Parent and child share a laptop.
- Each has a separate OptumRx (HSID) account.
- Each registers their own passkey.
Outcome:
- Passkeys are stored side‑by‑side.
- Browser prompts user to select the correct credential.
- HSID authenticates the selected account.
HSID does not enforce:
- One account per device.
- One account per browser.
- One passkey per browser profile.
Important constraint:
- Passkeys are always account‑specific.
- Passkeys cannot be used across user accounts.
Summary
| Scenario | Supported |
|---|---|
| Shared household device | Yes |
| Multiple OptumRx accounts | Yes |
| Cross‑user passkeys | No |
| Password/MFA fallback | Yes |
| Max passkeys per user | 6 |
Environment isolation
Environment specific passkeys
Are passkeys shared across PROD, STAGE, or other environments?
No.
- Passkeys are strictly environment‑scoped.
- A passkey created in STAGE will not work in PROD.
- Platform sync does not override this behavior.
Each environment requires its own passkey setup, which is expected and intentional.
Note:
To learn more about passkey, see Passkey section.
Previous:
Frequently asked questions
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909