Unraid Passkey Login

Log into the Unraid WebGUI with a passkey (Touch ID / Windows Hello / a security key) instead of a password — self-contained in Unraid's own web server. No cloud account, no Docker, no separate service, no OIDC. Your password login stays available as a fallback.

How it works

• A small PHP WebAuthn endpoint (webauthn.php, using the bundled lbuchs/WebAuthn library) runs inside Unraid's own nginx/PHP. On a successful assertion it creates the exact same session that Unraid's .login.php creates on a password login.
• The plugin injects a "Login with passkey" button into the login page and whitelists the two pre-auth endpoints in auth-request.php (the same mechanism Unraid's own SSO button uses). Both patches are re-applied on every boot and are idempotent.
• Public keys are stored in /boot/config/plugins/unraid-passkey/credentials.json on the flash drive — array-independent and reboot-safe.

Requirements

• Unraid 7.0+.
• The WebGUI reachable over HTTPS with a hostname (not a bare IP) — WebAuthn needs a secure context, and the passkey is bound to that hostname (RP ID).

Install

In Unraid go to Plugins → Install Plugin and paste:

https://raw.githubusercontent.com/fhirschmann/unraid-passkey/main/unraid-passkey.plg

Updates appear on the Plugins page like any other plugin.

Use

1. Open Settings → Passkey Login and register a passkey (you must be logged in with your password first).
2. Log out — the login page now shows "Login with passkey".

Passkey-only (disable the password)

Under Settings → Passkey Login you can tick Disable password login. The login page then only offers the passkey button, and password logins are rejected server-side. It requires at least one registered passkey, and recovery always remains: Safe Mode boots without plugins (password works) and SSH is unaffected — so this can't lock you out permanently.

Development

The WebAuthn library is a git submodule:

git clone --recurse-submodules https://github.com/fhirschmann/unraid-passkey
# or, after a plain clone:  git submodule update --init --recursive

build.sh / deploy.sh copy it into the package via vendor.sh.

Safety

• The password login is never removed; if anything breaks, log in as usual.
• Booting Unraid in Safe Mode starts without plugins (stock login).
• Uninstalling reverts the login page + whitelist; credentials are kept on flash until you delete /boot/config/plugins/unraid-passkey/.

Status

Experimental. Creates the WebGUI session by mirroring Unraid's own login flow — an unsupported internal detail that could change across Unraid releases (the password login remains as a fallback). MIT licensed.