WhatsApp, the world's largest messaging platform, adopted passkeys in 2023, enhancing user security and convenience. This initiative aimed to provide a fast, phishing-resistant authentication method that reduces user friction and protects against account takeovers. Mayank Manuja, an Android Engineer on the WhatsApp Registration and Access team, led this design and implementation. Building for billions of users required navigating diverse network conditions, device capabilities, and digital literacy levels. Passkeys offer a streamlined, one-tap login experience, leveraging public-private key cryptography with biometric or screen lock authentication. This significantly improves sign-in speeds and functions reliably even where traditional SMS OTP delivery is inconsistent.From a developer perspective, the Credential Manager API provided a unified interface, simplifying integration despite numerous edge cases across Android versions and device configurations. WhatsApp and Google collaborated to optimize credential lookup flow, improving latency for new passkey users. They also built a comprehensive error-handling layer to manage device-specific hurdles and ensure graceful degradation when passkey flows couldn't complete. Furthermore, they tackled OS-specific exceptions, implementing platform-level improvements for smoother passkey creation flows.WhatsApp refined the user experience through extensive A/B testing, developing a contextual framework for prompting passkey creation. On the backend, WhatsApp's server implements standard WebAuthn/FIDO2 ceremonies using Erlang and a Rust webauthn-rs library for signature verification. The server architecture orchestrates passkey registration by generating options for the client, verifying attestation, and securely persisting credentials. For authentication, it fetches valid credentials, generates a server-side challenge, and verifies the client's assertion.Advanced architectural considerations included migrating to a multi-passkey per account system, which required engineering a bounded list system to evict older credentials once a limit was reached. This significant structural shift was rolled out gradually through rigorous experimentation to ensure stability. Balancing the credential lifecycle also required careful management of credential validity.