Some passkey setups let you log in without even typing a username. What WebAuthn feature makes that possible?

"Resident keys," also called "discoverable credentials" — the authenticator stores enough account info to present the right credential itself, so the site needs neither a username nor a password.

Normally a WebAuthn login starts by sending a username so the server can return the matching allowCredentials list. With resident keys / discoverable credentials, the authenticator itself remembers which account a credential belongs to, so it can offer the correct passkey directly.

Per the c't developer article (2023), if your system supports resident keys you can "drop the username at login" entirely — the smoothest passkey experience. The same article notes implementations vary: Nextcloud's WebAuthn, for example, did not support resident keys at the time, so users there still had to type a username.

Tip: "Discoverable" = the credential can be discovered by the authenticator without the site naming it first. That's the technical prerequisite for true username-less, passwordless login.

Go deeper:

• Yubico: Discoverable Credentials / Resident Keys — how storing the credential on the authenticator lets the RP find the user with no username.