Set AUTH0_NATIVE_CLIENT_ID and AUTH0_DOMAIN in .env to enable.
Device-only. The app calls /passkey/register or /passkey/challenge, hands the options to the OS passkey sheet, then exchanges the result at /oauth/token.
See native/ios/PasskeyLogin.swift and native/android/PasskeyLogin.kt.
Two separate things: a passkey is unlocked with Face ID or fingerprint, and stored tokens can be gated by biometrics so reopening the app needs a face or finger, not a new login.
See native/ios/BiometricSession.swift and native/android/BiometricSession.kt.