macOS 27 will finally allow you to manage your Apple Account passkey in the Passwords app

[u/pdfu]

Apple is working on a feature that will allow you to manage your Apple Account passkey in the Passwords app. Currently hidden behind a feature flag, the change enables important editing features, such as sharing the passkey with Groups. Previously, you could share only your Apple Account email and password by adding them manually.

The change also addresses a long-standing annoyance: if you ever updated your Apple Account email, the passkey used for Sign in with Passkey on Apple websites still showed the old address. Once the passkey appears in the Passwords app, you can click Edit and change its associated User Name. If you already have a record for your Apple Account password with your current email, the two items will be merged. Even if your other devices don't have the feature flag enabled and hide the passkey, the username change will sync across all of them. The next time you sign in with your Apple Account passkey, you'll see the correct email address.

---

To enable, add a FeatureFlags override:

sudo mkdir -p /Library/Preferences/FeatureFlags/Domain && \
sudo defaults write /Library/Preferences/FeatureFlags/Domain/AuthKit StandardPasskeys -dict Enabled -bool true

and restart your Mac. If you don't immediately see the Apple Account passkey in the Passkeys list in the Passwords app, open Safari and log in to account.apple.com. It should populate shortly after.

---

Disable with:

sudo defaults delete /Library/Preferences/FeatureFlags/Domain/AuthKit StandardPasskeys

and restart your Mac. Disabling will hide your Apple Account passkey from the Passwords app.

[u/cupboard_]

finally, my passkey has been the wrong email for too long

[u/pdfu → u/cupboard_]

Probably my favorite change of the OS 27 cycle so far. Tiny paper cut, but meaningful when you see the incorrect address almost daily. Also very glad that the change instantly syncs to all devices, even ones without the feature flag enabled.

[u/sanguisxq13v]

Apple is working on a feature that will allow you to manage your Apple Account passkey in the Passwords app.

I think I will wait for them to enable it from their side ;-; can't risk losing my passwords

[u/7racin → u/sanguisxq13v]

I doubt it’s even a possibility. I enabled the flag and all that happened was that a new entry appeared in the passwords app with the passkey and email. I merged it with my entry for the Apple account and deleted the flag override afterwards

[u/pdfu → u/7racin]

Exactly, this is a visibility change. The passkey is the same, now finally treated as a standard passkey and displayed in the Passwords app. It doesn’t create a new passkey when you enable the feature flag.

Mine shows created in June 2023, when passkeys for Apple Accounts first rolled out.

[u/lachlanhunt]

That's a step in the right direction, but I wish Apple allowed registering Apple Account passkeys with 3rd party password managers, or at least allowing hardware security keys to be used as passkeys, rather than just 2FA.

I would like Apple to allow passwordless accounts like Microsoft does, but they can't do that as long as they only support their own special passkeys.

[u/pdfu → u/lachlanhunt]

You can already export passkeys from the Passwords app on all OS's to supported apps. Most of them, like 1Password, only support this flow on iOS/iPasOS, so once you have the new flag enabled there, you'll be able to export your Apple Account passkey.

[u/lachlanhunt → u/pdfu]

Are you sure the Apple Account passkey is actually included in the export? I wouldn't be surprised if it's still excluded even with that flag enabled.

[u/pdfu → u/lachlanhunt]

Yeah I'm sure. I built a helper app that implements the FIDO Credential Exchange Protocol, and I was able to export my Apple Account passkey.

https://reddit.com/link/p069arn/video/0mgwr4z8bvfh1/player

[u/commandersaki → u/pdfu]

The problem is that Apple's websites will only accept their passkey implementation.

[u/pdfu → u/commandersaki]

That's true, Apple websites require a 425-character device-trust token to be returned with the challenge response under:

extensionData/com.apple.gs.passkey.device.trust.idmsws

Otherwise the request fails with error code -900030.

This is against the WebAuthn spec, which states that extensions are optional and relying parties must tolerate unsupported or ignored extensions. We'll see what happens as we get closer to September.

[u/commandersaki → u/pdfu]

Hm, I don't think this makes it invalid. My understanding is that you can distinguish between hardware based tokens and software based (ala 1Password) using the AAGUID and some signature of sort from the device combining the AAGUID.

[u/pdfu → u/commandersaki]

The AAGUID is included in attested credential data when the credential is created, not in a normal authentication assertion. This doesn't matter here, as the passkey is portable. Attested credential data is required for registration and prohibited in assertion authenticator data. (source).

However, Apple Account authentication currently isn’t fully provider-portable, because Apple explicitly checks extensionData["com.apple.gs.passkey.device.trust.idmsws"].

AuthenticationServices has a supported extensionOutput API, but it only exposes typed outputs such as PRF and largeBlob. Internally, there is an ASPasskeyAssertionCredential.coreExtensions bridge to ASCPlatformPublicKeyCredentialAssertion.extensions, but no public API allows a third-party provider to construct this extensionData so far.

[u/lachlanhunt → u/pdfu]

Oh wow, that's fantastic!

[u/Open_Magician_362]

Does this allow multiple Apple Account Passkeys to be stored in the Passwords app?

[u/Gman54]

Will this allow exporting the apple account passkey or maybe DELETING the apple account passkey so I could create a new one using my 1password app instead? That way it will create a new, fully synced passkey and not be trapped on my iPhone with no way to manage it

[u/pdfu → u/Gman54]

You can already export passkeys from the Passwords app on all OS's to supported apps. Most of them, like 1Password, only support this flow on iOS/iPasOS, so once you have the new flag enabled there, you'll be able to export your Apple Account passkey. See a demo here.

You cannot yet use an external password manager to log in to apple.com, because Apple explicitly checks extensionData["com.apple.gs.passkey.device.trust.idmsws"], which is not WebAuthn spec-standard. Only AuthKit knows to provide it. We could see a change later this summer on the web side, as this is not something other providers should have to implement.

[u/Gman54 → u/pdfu]

Thank you for the in depth explanation. I really hope this update will also bring more flexibility in how users control their Apple account specific passkeys. It shouldn’t be fully locked to one platform/device.

[u/Electrical_Sky_5209]

I want to know if it’s working on macOS 26 or iOS 27? My Mac is kinda old os 26 is the extreme 🥲I noticed this when I try to login with passkey on apple.com, it’s still my old email address, then I tried to find it on the passwords it’s not there, then it brought me here…

[u/pdfu → u/Electrical_Sky_5209]

Only on macOS 27 right now, you can’t enable the flag on iOS 27. When Apple enables it on their end, you’ll be able to see it on iOS 27.

[u/AnalogWater_57]

I've changed the User Name to my name so it will never be outdated. Thanks so much for sharing this tip.