[austincalvelage]

Description

Fixes CORE-4060.

Mosaic was missing the option to use a passkey for the second verification step. This adds it and makes it the first choice when the account and browser support it, just like the old UI. Users can still choose another method.

The screenshots use the same test account setup. Both method menus are opened from the authenticator step.

View	Before	After
Default second factor
Alternatives from authenticator

Checklist

• Relevant tests run as expected: 75 reverification Chromium tests passed, with 1 preexisting TODO.
• pnpm build runs as expected.
• Mosaic typecheck, lint, and formatting pass.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Nov 2, 2026 8:08pm UTC
swingset	Ready	Preview	Nov 2, 2026 8:08pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 747481a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@clerk/mosaic	Patch
@clerk/swingset	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: clerk/javascript
• Branch: austin/core-4060-second-factor-passkeys
• File: .coderabbit.yaml
• Commit: 747481a
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: c9f3ed69-690d-4e38-a286-cdf7bce6580c

Commits

Reviewing files that changed from the base of the PR and between aa9a6a3 and 747481a.

Files selected for processing: 5

• .changeset/mosaic-second-factor-passkeys.md
• packages/mosaic/src/features/reverification/__tests__/reverification.feature.test.tsx
• packages/mosaic/src/features/reverification/reverification.model.tsx
• packages/mosaic/src/features/reverification/reverification.types.ts
• packages/mosaic/src/features/reverification/reverification.utils.ts

Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/clerk-android (auto-detected)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Walkthrough

Reverification now allows a configured passkey as either the first or second verification factor when WebAuthn is supported. Starting-method selection prioritizes available passkeys, and passkey verification uses the selected factor stage. Tests cover selection, multi-factor completion, factor state, abort handling, alternative methods, and unsupported-WebAuthn fallback. A patch changeset records the feature.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: ephem, alexcarpenter

Merge Risk: Minimal · up to 74748

Passkeys are available at either reverification stage. No merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding second-factor passkey support to Mosaic reverification.
Description check		The description directly explains the second-factor passkey fix, fallback behavior, test results, and related issue.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 5 functions across 4 files. (1 skipped: 1 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10570

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10570

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10570

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10570

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10570

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10570

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10570

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10570

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10570

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10570

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10570

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10570

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10570

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10570

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10570

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10570

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10570

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10570

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10570

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10570

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10570

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10570

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10570

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10570

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10570

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10570

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10570

commit: 747481a