API usage


The data collected for the Passkeys Directory website is available as JSON files to enable developers to use it in their programs. You are free to use the API data as you wish, as long as you adhere to the repository license.

Please be aware that any icons included in this repository are the intellectual property of their respective authors. Redistribution of these icons freely through our API exceeds the bounds of normal fair-use principles. The API does, therefore, not provide a means for fetching website icons. We appreciate your understanding and adherence to these terms as we strive to respect the rights of icon creators.

Optimizing API Usage and Dataset Retrieval

If you anticipate frequent and high-traffic queries on our JSON files, Cloudflare, our reverse proxy provider, may be blocked. We recommend locally caching the files to optimize performance, especially for scenarios involving substantial traffic. For specific datasets, such as all sites supporting passwordless authentication, consider utilizing the corresponding URI for more targeted and efficient results. Refer to URIs for the available paths.

Version 1


CoverageUnsigned FilePGP Signed File
All websites.https://api.passkeys.2fa.directory/v1/all.jsonhttps://api.passkeys.2fa.directory/v1/all.json.sig
Websites with any form of passkey support.https://api.passkeys.2fa.directory/v1/supported.jsonhttps://api.passkeys.2fa.directory/v1/supported.json.sig
Websites supporting passwordless authentication.https://api.passkeys.2fa.directory/v1/passwordless.jsonhttps://api.passkeys.2fa.directory/v1/passwordless.json.sig
Websites supporting passkey multi factor authentication.https://api.passkeys.2fa.directory/v1/mfa.jsonhttps://api.passkeys.2fa.directory/v1/mfa.json.sig


Below you’ll find a table describing all possible keys in the API files.
You can also use the JSON Schema for a more complete overview.

KeyValue TypePatternDescription
urlURIuriURL of the site. If this is not defined, the url is https://domain
additional-domainsArray<String>hostname (RFC-1123 2.1)Array of domains that the site exists at in addition to the main domain listed in the domain field.
mfaString/^(allowed|required)$/Contains allowed if passwordless authentication is supported but optional. Contains required if the service forces the usage of passwordless authentication.
passwordlessString/^(allowed|required)$/Contains allowed if passkey as MFA authentication is supported but optional. Contains required if the service forces the usage of passkeys as MFA authentication.
documentationURIuriURL to documentation page
recoveryURIuriURL to recovery documentation page
notesString/^(\w){10,}$/Text describing any discrepancies in the 2FA implementation
contactObjectSee Contact Object ElementsObject containing contact details. See table below for elements
regionsArray<String>/^-?[a-z]{2}$/Array containing ISO 3166-1 country codes of the regions in which the site is available. If the site is available everywhere apart from a specific region, that region will be prefixed by a - symbol

Contact Object Elements

twitterString/^(\w){1,15}$/Twitter/X handle
facebookString/^(\w){1,}$/Facebook page name
emailStringemail (RFC-5321 4.1.2)Email address to support
formStringuriSupport contact form
languageString/^[a-z]{2}$/Lowercase ISO 639-1 language code for the site if it is not in English

Example website with passkey support

  "example.com": {
    "passwordless": "allowed",
    "mfa": "allowed",
    "documentation": "https://example.com/support/enable-passkey.html"

Example website without passkey support

  "example.com": {
    "contact": {
      "twitter": "example",
      "facebook": "example",
      "email": "[email protected]"