Environment settings (RP ID, origins, residentKey, userVerification)
For each environment, set the domain passkeys are bound to (RP ID), the accepted origins and the conditions for registration and login.
Change the settings
- Open the project and choose the Live or Test environment in the switcher.
- Click "Environment settings" in the menu.
- Change the fields and click "Save".
Developers, Admins and Owners can change the settings. Viewers see the values only.
Fields
| Field | Description |
|---|---|
| RP ID | The domain passkeys are bound to (relying party ID): the domain of your login page or its parent domain. |
| Name shown in the authentication dialog | The name shown in the device's passkey dialog (up to 100 characters). |
| Origins | The origins that accept passkey registration and login, one per line. |
| Password login end date | Enter a date. Once that date ends (24:00 Japan time, UTC+9), login responses for users with a passkey return password_allowed: false; through the end of the date they return true (for December 31, false starts at 00:00 on January 1). You can use it to hide the password field. Leave empty for no end date. password_coexist_until in the API returns the end time (…-12-31T15:00:00.000Z for December 31). |
| Discoverable credentials (residentKey) | preferred (default), required or discouraged. Choose required if you only use username-less login or autofill. |
| User verification (userVerification) | preferred (default) or required. With required, registration and login without biometric or PIN verification are rejected. |
| Webhook | The destination URL. See Webhooks. |
The environment ID (app_id in the API) is shown at the bottom.
Before you change the RP ID
Changing the RP ID makes the passkeys registered in this environment unusable, and users will need to register a passkey again.
- When you change the RP ID and click "Save", a "Change RP ID" confirmation dialog appears.
- The dialog shows how many active passkeys and users will be affected. If the environment has no active passkeys, it says no users are affected.
- Check the details and click "Change and save". Click "Cancel" to keep the current RP ID.
Changing the RP ID back makes passkeys that have not been revoked work again. The change is recorded in the audit log as "Environment settings changed", with the previous value (previousRpId). The RP ID can only be changed in the dashboard, not with an API key or MCP.
How to write origins
- Enter
https://origins on the RP ID domain or its subdomains (for example,https://login.example.com), without a path,?or#. http://localhostfor development can be entered withouthttps://.- For Android apps, enter a value starting with
android:apk-key-hash:or the SHA-256 fingerprint of the signing certificate (AB:CD:...), which is converted when saved. You can register up to 10 Android app origins. - iOS apps use
https://{RP ID}as is. See Native apps in the API reference.
Related pages
API reference
For the API, browser SDK and MCP, see the API reference. If you have questions, please contact us.