passkey and associated domains apple-app-site-association
Asked on 2026-10-15
1 search
Apple’s passkey work ties into associated domains through the standard way apps and websites claim a domain for secure credential sharing and sign-in.
From the WWDC passkeys sessions:
- Passkeys and credential managers rely on your website/app being properly associated so the system can recognize the domain and offer the right credentials.
- Apple recommends adopting the well-known passkey management endpoints so credential managers can deep-link people to passkey enrollment and management pages.
- These endpoints must be served directly from the well-known path, with a 200 OK and
application/jsoncontent type, and not via redirect. - The pages behind those links should work for all user agents, not just browsers, because credential managers and apps may request them too.
The relevant newer session is What’s new in passkeys (WWDC25), especially the section on Passkey management endpoints.
If you want, I can also explain how apple-app-site-association fits with passkeys and associated domains in practice.
What’s new in passkeys
Discover how iOS, iPadOS, macOS, and visionOS 26 enhance passkeys. We’ll explore key updates including: the new account creation API for streamlined sign-up, keeping passkeys up-to-date, new ways to drive passkey upgrades through automatic passkey upgrades and passkey management endpoints, and the secure import/export of passkeys. Learn how these improvements enhance user experience and security, and how to implement these updates in your apps to provide a smoother, more secure authentication experience. To get the most out of this video, first watch “Meet passkeys” from WWDC22.
What’s new in device management
Learn about the latest management capabilities for iOS, iPadOS, macOS, and visionOS, then discover the latest changes to Apple Business Manager and Apple School Manager. We’ll also share updates to Activation Lock, SoftwareUpdate, and Safari management.
What’s new in privacy
At Apple, we believe privacy is a fundamental human right. Learn about new and improved permission flows and other features that manage data in a privacy-preserving way, so that you can focus on creating great app experiences.