No Display? No Problem: Cross-Device Passkey Authentication for XR Devices (opens in new tab)

Passkeys provide phishing-resistant authentication, but standard cross-device flows depend on QR codes displayed on the device being authenticated. This creates a problem for XR headsets, smart-home hubs, sensors, and other devices with no accessible screen. The proposed solution uses an authenticated companion app to transport the FIDO hybrid-flow request, preserving proximity, trust, and standard WebAuthn security without requiring a QR code.

The Challenge: Screenless Devices Cannot Display QR Codes

• Traditional cross-device passkey authentication uses:
  • A QR code displayed by the desktop or other target device.
  • Bluetooth or NFC to verify proximity and establish communication.
• Devices without usable displays cannot show a QR code for a phone to scan.
• Proximity discovery alone is insufficient because users still need a clear, secure way to approve the correct authentication request.

Companion Apps as Secure Message Transport

• The target device generates the same hybrid-flow request normally encoded in a QR code.
• Instead of displaying it, the device sends the request to an authenticated companion app associated with the same user account.
• In-app notifications provide a user-consent surface and direct the user into the passkey flow.
• Opening the app itself can initiate the flow because the user must deliberately open it, and mobile operating systems provide an additional verification step.

Meta Quest and Meta Horizon Implementation

• The implementation is broadly available on Meta Quest devices running Meta Horizon OS.
• The Quest browser creates a FIDO URL containing:
  • A fresh ECDH public key.
  • A session-specific secret.
  • Routing information for the hybrid handshake.
• The URL is packaged as structured data in a GraphQL-based push notification.
• The Meta Horizon app validates that the request belongs to the correct signed-in user before processing it.

Notification and Deep-Link Flow

• iOS or Android displays a notification that a passkey login is pending.
• Tapping the notification opens the Meta Horizon app, which launches the FIDO URL through the operating system.
• The OS then invokes its passkey interface.
• If notifications are disabled, opening the app queries the backend for pending requests.
• Requests expire after five minutes, limiting the window for misuse.
• The mobile device then performs the normal hybrid transport process:
  • Broadcasting a BLE advertisement.
  • Establishing an encrypted tunnel.
  • Generating the passkey assertion.

WebAuthn Challenge and Response

• The inaccessible device creates the normal WebAuthn challenge and waits for a response.
• The mobile authenticator initiates the secure BLE or NFC connection.
• The challenge travels through the encrypted channel.
• After successful user verification, the phone creates an AuthenticatorAssertionResponse or AuthenticatorAttestationResponse.
• The inaccessible device forwards that response to the relying-party server just as a display-equipped device would.

Broader Impact

• The approach removes the QR-code requirement while retaining FIDO hybrid transport and proximity protections.
• It could extend passwordless authentication to:
  • XR headsets and wearables.
  • Screenless IoT devices.
  • Smart-home hubs.
  • Industrial sensors and hardware.
• The work builds on FIDO Alliance standards and mobile operating-system support, helping broaden interoperability across device ecosystems.

The companion-app model offers a practical way to bring secure cross-device passkeys to devices that cannot display QR codes. It is especially suitable where the device already has an authenticated mobile app and can rely on standard WebAuthn, BLE/NFC proximity, and platform user verification.