Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi <@U04UQ68083H>! Is there a reason that login hook "require_verified_address" only works with password and not with passkey or webauthn?

Hmm, I don't know enough to give you a confident answer yet. The knowledge sources provided do not specify whether the `require_verified_address` login hook works exclusively with passwords and not with passkeys or WebAuthn.   However, it's worth noting that the `require_verified_address` action is used to ensure that users have a verified email address before they are able to sign in to the application. This action checks whether the user's email address has been verified before allowing them to sign in. If the email address has not been verified, the user will not be able to sign in and will receive an error message [source](<https://www.ory.sh/docs/actions/require-verified-address>).  For more specific information about how this hook interacts with different authentication methods like passkeys or WebAuthn, I would recommend checking the official Ory documentation or reaching out to the Ory community for more detailed guidance.