PasskeyLogin - support thread

Passkey Login (WebAuthn) — passwordless sign in for Zen Cart

First WebAuthn / FIDO2 passkey implementation for Zen Cart. Customers sign in with Face ID, a fingerprint, Windows Hello, or a hardware security key instead of typing a password. Saved passkeys appear inside the browser's own autofill on the login page (conditional UI) — no new buttons, and no change for customers who don't use them. Passkeys are added alongside password login, not instead of it.

Download: https://github.com/CcMarc/PasskeyLogin/releases/latest
Plugin library: submitted to the Zen Cart plugin library - pending approval.

Docs: README · CHANGELOG · SECURITY

Highlights

• No core edits, no template edits — encapsulated plugin, installs via Plugin Manager
• Passkeys account page (add / rename / remove) plus a My Account tile and a one-time, dismissible enrollment invitation
• Smart default passkey names from the AAGUID registry ("Apple Passwords", "Google Password Manager", …)
• Sign in runs through core Customer::login() — session, cart restore, and authorization behavior match password login exactly
• Admin console under Extras: status, customer lookup with support removal, activity, debug log tail, maintenance sweep
• One Page Checkout aware (shared guest account can never hold a passkey); OPC not required
• Hardened ceremonies: database-backed single-use challenges, clone detection, per-IP rate caps, strict payload limits
• Data tables preserved on uninstall — customers keep their passkeys across reinstalls

Requirements: Zen Cart 2.1.0+ (developed and tested on 2.2.2), PHP 8.0+ with OpenSSL, HTTPS.

Status and testing

v1.0.0, developed and running live on my own 2.2.2 production store. My own traffic can't cover the full device matrix, so feedback and testing are very welcome — especially:

• Android / Google Password Manager sign-ins
• Windows Hello and hardware security keys
• Password managers like Bitwarden or 1Password as the passkey provider
• Stores without One Page Checkout
• Zen Cart 2.1.x installs (every core API is verified present in the 2.1.0 source, but I've only run it live on 2.2.2)

Security reports: please use GitHub's private vulnerability reporting (see SECURITY.md) rather than posting publicly.
Questions and issues welcome in this thread.

Tried it, but I was unable to create a passkey. At login I choose to use a passkey, then choose mobile device, and a QR code is displayed. I scan the QR code with my iPhone, on which a message 'connecting' appears, and it hangs out like this until timeout.

ZC v2.2.2, PHP 8.4. Firefox on PC for the client login side and iPhone 7 for verification. There are no error log files in ZC or Apache. If I activate the plugin log function, there is just one line with event... login and the domain name by memory (it's already deleted).

Any idea what is going wrong, please?

pilou2:

Tried it, but I was unable to create a passkey. At login I choose to use a passkey, then choose mobile device, and a QR code is displayed. I scan the QR code with my iPhone, on which a message 'connecting' appears, and it hangs out like this until timeout.

ZC v2.2.2, PHP 8.4. Firefox on PC for the client login side and iPhone 7 for verification. There are no error log files in ZC or Apache. If I activate the plugin log function, there is just one line with event... login and the domain name by memory (it's already deleted).

Any idea what is going wrong, please?

Thanks for testing and for the detailed report. Good news: nothing is wrong with your installation. Your debug log showing a single options event with no follow-up means the server issued the sign-in challenge and the phone never completed the ceremony, which matches the real cause:

The iPhone 7 cannot complete the QR passkey flow. Cross-device passkeys (the QR code handshake) require iOS 16 or later, and iOS 16 requires an iPhone 8 or newer. The iPhone 7 stops at iOS 15, which has no passkey support, so the "connecting" screen can never finish. That is an Apple platform limit, not something the plugin (or any website) can work around.

For anyone testing the QR flow, the requirements on the phone side are: iOS 16+ (iPhone 8 or newer) or Android 9+ with Google Play services, Bluetooth turned ON on both the phone and the computer (the handshake uses Bluetooth proximity to prevent phishing), and internet on both devices.

Two more tips for your setup:

The easiest way to create your first passkey is directly on a supported phone: sign in with your password on the phone's browser, go to My Account, open Passkeys, and tap Add a Passkey. Face ID / Touch ID and done, no QR involved. The QR flow is mainly for signing in on a computer afterwards.
Note that Firefox does not yet support the "conditional UI" that shows passkeys in the email field suggestions, so on the login page Firefox will not offer a passkey even after you have one. Chrome, Edge, and Safari all do. Firefox users can continue signing in normally; nothing breaks, they just do not see the passkey option.

Hope that helps, and thanks again for kicking the tires.

Thanks for this quick answer and detailed explanation.
With an iPhone 7, there are tons of apps that won't work anymore...

You should add the explanation above on passkey creation to the plugin release; it would make things clear and easier.

I found a problem, nothing to do with my first post. When you click on the link Open settings in the Extras->Passkey login page, I got this log file:

[27-Aug-2026 06:02:50 Asia/Tokyo] Request URI: /admin/index.php?cmd=configuration&action=locate&configuration_key=PKL_ENABLED, IP address: 0.0.0.0, Language id 1
#0 ..\admin\includes\init_includes\init_templates.php(40): zen_debug_error_handler()
#1 ..\includes\autoload_func.php(40): require_once('...')
#2 ..\admin\includes\application_top.php(54): require('...')
#3 ..\admin\configuration.php(8): require('...')
#4 ..\admin\index.php(16): require('...')
--> PHP Warning: Undefined array key "gID" in ..\admin\includes\init_includes\init_templates.php on line 40.

pilou2:

Thanks for this quick answer and detailed explanation.
With an iPhone 7, there are tons of apps that won't work anymore...

You should add the explanation above on passkey creation to the plugin release; it would make things clear and easier.

I found a problem, nothing to do with my first post. When you click on the link Open settings in the Extras->Passkey login page, I got this log file:

[27-Aug-2026 06:02:50 Asia/Tokyo] Request URI: /admin/index.php?cmd=configuration&action=locate&configuration_key=PKL_ENABLED, IP address: 0.0.0.0, Language id 1
#0 ..\admin\includes\init_includes\init_templates.php(40): zen_debug_error_handler()
#1 ..\includes\autoload_func.php(40): require_once('...')
#2 ..\admin\includes\application_top.php(54): require('...')
#3 ..\admin\configuration.php(8): require('...')
#4 ..\admin\index.php(16): require('...')
--> PHP Warning: Undefined array key "gID" in ..\admin\includes\init_includes\init_templates.php on line 40.

The Open Settings bug is fixed, and the README now covers the device requirements discussed above (iOS 16+, Bluetooth for the QR flow, Firefox limitations).

The fix is on GitHub as v1.0.1: https://github.com/CcMarc/PasskeyLogin

I'm not attaching a zip for this one on purpose. While early feedback comes in, I'll keep updating v1.0.1 directly on GitHub, so downloading from the repo always gets you the latest fixes. Once it's had time to prove stable, I'll publish it as the official release.

Upgrading from v1.0.0: upload the new v1.0.1 folder alongside the old one and run Plugin Manager's Upgrade (or uninstall/reinstall). Your passkeys and settings are preserved either way.

Thanks again for the reports; keep them coming.

Found some hardcoded text. In admin/passkey_login_console.php, there are no language constants used; all the displayed English text is hardcoded into the file, which makes it impossible to change language on the fly.

pilou2:

Found some hardcoded text. In admin/passkey_login_console.php, there are no language constants used; all the displayed English text is hardcoded into the file, which makes it impossible to change language on the fly.

Good catch, and thank you. You're right, the admin console had its English text hardcoded. GitHub is updated: every string the console displays now comes from language constants in the admin language file (lang.passkey_login_admin.php), so a translation can be added as an additional language file without touching any code. The customer-facing pages were already constant-based.

Grab the latest from the repo to pick up the change.

Thank you for correcting this so quickly.
I now have some translations ready in French and Japanese. However, there's a particular sentence constructed using PHP constants, HTML tags, and a hardcoded dot that I'm unable to accurately reproduce using the actual code. The Japanese sentence structure is significantly different, and the final dot is not . but 。.
Hopefully, a minor code adjustment will resolve the issue.
In the file admin/passkey_login_console.php, replacing line 155 with the following:

<?php echo sprintf(PKL_CON_STATE_PREFIX, $pklEnabled ? PKL_CON_ENABLED : PKL_CON_DISABLED); ?>

And in the file admin/languages/english/extra_definitions/lang.passkey_login_admin.php, changing line 23 (the constant PKL_CON_STATE_PREFIX) to this:

'PKL_CON_STATE_PREFIX' => 'Passkey login is <strong>%s</strong>.'

will resolve the issue.

If you would like to incorporate these translations into your plugin, I would be happy to make a PR on GitHub. Anyway they will be included with their respective language packs.

pilou2:

Thanks for correcting this quickly.
I now have some translations ready in French and Japanese. But there is a sentence built by the concatenation of PHP constants, HTML tags, and a hardcoded dot that I can't get right with the actual code. Japanese sentence structure is very different, and the final dot is not . but 。.
Hopefully, a small code modification can solve the problem.
In file admin/passkey_login_console.php, replacing line 155 with this:

                    <p><?php echo sprintf(PKL_CON_STATE_PREFIX, $pklEnabled ? PKL_CON_ENABLED : PKL_CON_DISABLED); ?>

And in file admin/languages/english/extra_definitions/lang.passkey_login_admin.php, changing line 23 (constant PKL_CON_STATE_PREFIX) to this:

    'PKL_CON_STATE_PREFIX' => 'Passkey login is <strong>%s</strong>.',

will solve the problem.

Applied exactly as you proposed, and thank you. That's a textbook example of why string extraction alone isn't enough: the sentence structure has to be translatable too. GitHub is updated. While applying it I found one more of the same kind and fixed it in the same pass: the "(id N)" after the customer name in lookup results is now a PKL_CON_LOOKUP_ID template, so its punctuation and format are yours to translate as well.

And yes please on the French and Japanese files. If you're comfortable with GitHub, open a pull request adding them under admin/includes/languages/french/extra_definitions/ and admin/includes/languages/japanese/extra_definitions/. Otherwise just attach them here to the thread and I'll add them to the repo. Either way they'd ship with the plugin for everyone.

Translations for French and Japanese have been added to GitHub as PRs.
Both the admin (including database menus) and catalog are translated. I also did the part in Publish directory.

pilou2:

Translations for French and Japanese have been added to GitHub as PRs.
Both the admin (including database menus) and catalog are translated. I also did the part in Publish directory.

Both translation pull requests are merged. Thank you for the excellent work — full key coverage on every file, and the lang.menu.php approach for the configuration labels and Plugin Manager listing was a nice touch I hadn't covered myself.

The plugin now ships English, French, and Japanese: admin console, configuration labels, catalog text, and the passkey settings page. You're noted in the README and in the file headers, and the latest is on GitHub as always.

For anyone else reading: translations for other languages are welcome — the README's Translations section explains the file layout, and the English files are the canonical key list. Pull request or post them here, either works.

And thanks to you for this plugin that should help keep it attractive for new users.