The identity industry often frames the discussion as passkeys or digital credentials. But Andrew Shikiar, CEO at the FIDO Alliance, argues it should really be an and.
Even once digital credentials are deployed at scale, there will still be plenty of cases where pseudonymous sign-in with a passkey is exactly what you want. You do not need to reveal verified identity information every time you open an email account or sign into an app.
That is worth unpacking, because passkeys and digital credentials answer different questions.
What a passkey is
A passkey is a way to sign in without a password.
When you create one, a cryptographic credential is registered to your account.
Later, when you sign in, your device proves it holds the corresponding private key, usually after you unlock it with Face ID, a fingerprint or PIN.
For example, when you sign into your banking app with a passkey, the bank can verify that the sign-in is coming from a credential already registered to your account.
What it does not tell the bank is who you are in the real world. Any real-world identity binding happens separately.
So a passkey primarily answers:
Does this sign-in use a credential registered to this account?
What a verifiable credential is
A verifiable credential is a digitally signed piece of information about you issued by a trusted organization.
For example, a government could issue a credential containing your age, or a bank could issue one confirming that it has already verified your identity. You can then present that information to another organization, which can check that it genuinely came from the issuer and has not been altered.
Depending on the credential format, you may also be able to reveal only the information needed. For example, you could prove that you are over 18 without sharing your full identity details.
So a credential answers a different question:
What is true about this person, and who is willing to vouch for it?
The division of labor
Once you look at the limits of each technology, a natural division of labor starts to emerge.
Shikiar described how FIDO spent its first decade heavily focused on sign-in because credential theft and phishing were such major attack vectors.
Passkeys address that problem extremely well.
But when you strengthen one part of the identity lifecycle, attackers move somewhere else.
Increasingly, that means moving earlier in the process: account creation, enrollment and the question of whether there is a genuine, verified person behind an account.
That creates a useful model:
Credentials at onboarding. Passkeys at sign-in.
At account creation, the right trusted credential can provide something a passkey alone cannot: verified information about the person.
Are they a real person? Are they who they claim to be? Are they eligible for this service.
Instead of repeatedly uploading identity documents and going through a new verification process, a user could present trusted credentials and disclose only the attributes the service actually needs.
At sign-in, a passkey does something a full identity presentation would often be unnecessary for.
You do not need to re-prove your identity every time you open your email or access an app. You need strong assurance that the authentication credential registered to the account is being used.
Then there is recovery.
Recovery can undermine otherwise phishing-resistant authentication if the fallback drops back to weaker mechanisms such as emailed links or SMS codes.
Digital credentials create another option.
If someone loses access to their usual authenticator, a trusted credential could form part of a higher-assurance recovery process instead of relying entirely on a weak fallback.
And at high-risk moments, the two can work together again.
The passkey authenticates access to the account. A large transfer, age-restricted purchase or regulated action might then require an additional verified attribute appropriate to that specific transaction.
The part that is already shipping
This is not just an architectural idea.
The infrastructure supporting passkeys and digital credentials is beginning to converge.
The W3C Digital Credentials API allows websites to request digital credentials from credential managers, such as digital wallets, with the browser mediating the exchange. It builds on the same Credential Management API framework that WebAuthn extends.
From a developer’s perspective, that starts to create a more consistent browser-mediated model for both authentication and credential presentation, even though they are answering different questions.
Browser support has also moved quickly.
Chrome introduced stable Digital Credentials API presentation support in 2025, and Safari 26 added support the same year. Chrome has since begun testing credential issuance through the API as well as presentation.
The EUDI Architecture and Reference Framework is also moving in this direction. It anticipates support for the Digital Credentials API once conditions including W3C standardization and sufficient platform support are met.
FIDO has put the broader idea in writing too.
Its position is that passkeys and verifiable digital credentials should be viewed as a harmonized approach to digital identity, rather than competing technologies.
A passkey can provide strong authentication into an account or wallet.
A digital credential can provide verified information when the interaction actually requires it.
