Direct answer
Do not force users to transcribe a password or one-time code from memory. WCAG 2.2 Success Criterion 3.3.8 (Accessible Authentication, Minimum) requires a method that is not a cognitive function test. Allowing paste, a password manager, or WebAuthn passkeys all qualify.
On 25 August 2026 WebAuthn Level 3 became a W3C Recommendation. Conditional mediation (passkey autofill) is now a stable part of the platform, not an experiment.
What to ship on a B2B login
Keep username + password with autocomplete and paste enabled. Add passkey autofill with autocomplete="username webauthn" and a conditional get(), as web.dev documents. Do not block paste. Do not use puzzle CAPTCHAs as the only second factor.
Passkeys are origin-bound. Do not expect a passkey created on localhost to work on production, or a satellite domain to share credentials with the apex.
A practical sequence
Accessibility first, then convenience.
- Confirm paste works on password and OTP fields
- Add autocomplete tokens the browser already understands
- Offer passkey sign-in as an alternative, not a mandate
- Keep a recovery path that is also not a memory test
- Test with a password manager and a hardware key
Operator panels are not exempt
Staff logins must meet the same criterion. A ‘secure’ operator console that bans paste is less accessible and often less secure, because people write passwords in notes.
What to send if you want a senior review
Share the identity provider you already use and whether staff and clients share a login. Related work at Kiwi: SaaS MVP design and development.
Frequently asked questions
Are passkeys required for WCAG 2.2 AA?
No. They are a sufficient technique. Allowing password-manager paste also meets 3.3.8. Blocking paste fails it.
Should we remove passwords on day one?
Usually no. Ship passkeys beside passwords. Conditional create can upgrade users later without a separate ceremony.
Do passkeys replace access control?
No. Passkeys prove who is at the keyboard. Authorization still decides which workspace and which object they may see.
Sources
- FIDO Alliance — WebAuthn Level 3 is a W3C Recommendation
- W3C — Understanding Accessible Authentication (Minimum)
- web.dev — Sign in with a passkey through form autofill
Figures cited above are drawn from the linked publications and are the responsibility of their sources; we date and scope them rather than presenting them as universal guarantees.