How To Manage Okta Passkeys

This article applies to employees already enrolled in Okta Passwordless. New hires should follow the instructions in the Welcome email they received on their first working day. Existing employees who have not enrolled need to follow the Enroll in Okta Passwordless article.

This article explains what passkeys are, where to find them, how to manage them, and how to set up your devices.

Passkeys Explained

What are passkeys?#

A passkey is a replacement for passwords that makes logging in easier and safer. It doesn’t need to be remembered, like a password, and instead of typing it in, the fingerprint, face, or device PIN is used to sign in.

How Passkeys Work #

You create a passkey.
1. When signing up or logging into a website or app that supports passkeys, it will ask if you want to create one.
2. Instead of setting a password, you confirm with Face ID, fingerprint, or your phone's PIN.
The passkey gets stored securely.
1. Your phone or computer saves the passkey in a secure place (like Google Password Manager or iCloud). It can’t be stolen in a data breach like a password could and it’s phishing-resistant.
Use the passkey to log in.
1. Next time you visit the website or app, just use TouchID (or Face ID or your fingerprint), and you’re in—no password needed!

To learn more about Okta visit Learn About Okta Passwordless.

Manage Passkeys#

Employees who are already enrolled in Okta Passwordless can easily view all of their passkeys by going to wic.prod.netflix.net. Sign in, select your Name, then Settings.The passkeys are found under Security Methods and are split up into two sections:

Okta Verify#

These are the Okta Verify apps set up on your devices (laptops and cellphones). This is also referred to as Okta FastPass.

Security Key or Biometric Authenticator#

Depending on which devices you have, these can be:
- MacBook Touch ID: The macOS Touch ID
- Windows Hello Hardware Authenticator: The Windows Hello Face Recognition or PIN
- Authenticator: Such as a YubiKey (also known as security key or physical key)
- Security Key or Biometric: Which includes passkeys stored in iCloud, Android, Google Password Manager, Chrome Profile, and Chromebook

Passkeys can be nicknamed to be easily identifiable.

Note that Netflix does not require you to use a biometric reader for authentication. You may always opt to use a non-biometric authentication method instead, such as a PIN or password. If you choose to use the biometric reader on your device, you consent to the use of the biometric reader for authentication purposes. Refer to the Netflix Biometric Readers Policy for more information.

Select your device to set up a passkey

macOS

We recommend creating a passkey for all of your Netflix-issued devices, including any cellphones and secondary desktops, that access Netflix resources. For macOS devices, these passkeys are required:

Okta Verify
MacBook Touch ID, local pass or iCloud
A security key or biometric if not using iCloud

Set up Okta Verify

Set up Okta Verify on one device using another device that already has Okta Verify enabled.

If you do not have Okta Verify set up on any other device, reference Set Up Okta Verify When No Other Device is Available.

Confirm that both of your devices have Bluetooth turned on.
Open the Okta Verify app on the device that is already set up.
Select the account and select Add Account to Another Device. A QR code and a setup code are displayed. Note the setup code for later.
Download the Okta Verify app from the relevant App Store on the new device.
1. For Android, download the Okta Verify app to your Work profile.
Open the Okta Verify app on the new device:
1. On a Windows or macOS device.
  1. Select Add Account.
  2. Enter the setup code from Step 2 on the new device. Another code will display.
  3. Enter the returned code on the device with Okta Verify already set up.
  4. Select Enable for Touch ID or Windows Hello confirmation.
2. On iOS or Android:
  1. Select Get Started and then select Next.
  2. Select Add account.
  3. Select Organization.
  4. Select Add account from another device.
  5. Select Scan QR code and scan the QR code. A setup code is displayed.
  6. Enter the setup code on the device with Okta Verify already set up.
  7. Select Got it and Allow for notifications.
  8. Select Enable to Enable screen lock confirmation.

Set up MacBook TouchID, local password or iCloud

Note that if iCloud was already being used and the same iCloud account is going to be used, you shouldn’t need to create a new passkey in iCloud, as there should already be one stored. Passkeys stored in iCloud are shared between all devices using the same iCloud account.

On your computer, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up, then Set up again.
When a macOS device is signed into iCloud, macOS automatically gives a Sign In prompt to store the passkey on your iCloud Keychain.
1. Choose this option to store the passkey on iCloud.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up security key or biometric passkey

A security key or biometric passkey is required if iCloud is not being used on the macOS. In this case the passkey can be stored on the Google Chrome profile.

We also recommend following these steps to create more passkeys so that if one method fails, another method can be used to log in. Note that there is a limit of 10 passkeys.

On your computer, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up, then Set up again.
When prompted to Choose where to save your passkey for wic.prod.netflix.net, select Your Chrome Profile to store the passkey on the Chrome profile.
Select Continue to save the passkey.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Windows

We recommend creating a passkey for all of your Netflix-issued devices, including any cellphones and secondary desktops, that access Netflix resources. For Windows devices, these passkeys are required:

Okta Verify
Windows Hello

Set up Okta Verify

Set up Okta Verify on one device using another device that already has Okta Verify enabled.

If you do not have Okta Verify set up on any other device, reference Set Up Okta Verify When No Other Device is Available.

Confirm that both of your devices have Bluetooth turned on.
Open the Okta Verify app on the device that is already set up.
Select the account and select Add Account to Another Device. A QR code and a setup code are displayed. Note the setup code for later.
Download the Okta Verify app from the relevant App Store on the new device.
1. For Android, download the Okta Verify app to your Work profile.
Open the Okta Verify app on the new device:
1. On a Windows or macOS device.
  1. Select Add Account.
  2. Enter the setup code from Step 2 on the new device. Another code will display.
  3. Enter the returned code on the device with Okta Verify already set up.
  4. Select Enable for Touch ID or Windows Hello confirmation.
2. On iOS or Android:
  1. Select Get Started and then select Next.
  2. Select Add account.
  3. Select Organization.
  4. Select Add account from another device.
  5. Select Scan QR code and scan the QR code. A setup code is displayed.
  6. Enter the setup code on the device with Okta Verify already set up.
  7. Select Got it and Allow for notifications.
  8. Select Enable to Enable screen lock confirmation.

Set up Windows Hello

On your computer, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up, then Set up again.
Select Face or PIN to save a passkey on the Windows device.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Chromebook (including loaners)

During your first sign-in on a new Chromebook, reinstalled Chromebook, or a loaner Chromebook, an existing passkey saved on a phone or a configured YubiKey is required.

Log in using an existing passkey saved on a phone

Power on the Chromebook device.
Enter your email address when prompted to sign in.
Enter your email address when prompted again to sign in.
At the Passkeys & Security Keys window, a QR code is displayed. Scan this with the camera of your phone.
1. Note that if there are multiple profiles on an Android device, the passkey might be saved on a different profile, so make sure to scan the QR code with the camera app of the relevant profile.
Confirm authentication on the phone.
Create a local passkey for the Chromebook, confirm it, and select Next.

If no passkey exists on the phone, reference set up the passkey on iCloud or Android to create one.

Log in using a configured YubiKey

If you have not set up your YubiKey as a passkey, refer to the Yubikey section for guidance.

Plug in the YubiKey and power on the Chromebook device.
Enter your email address when prompted to sign in.
Enter your email address when prompted again to sign in.
At the Passkeys & Security Keys window, touch the YubiKey.
Enter the PIN of the YubiKey and select Next.
Touch the YubiKey again.
Create a local passkey for the Chromebook, confirm it, and select Next.
Use the local password to sign into the device.

For loaner devices, the local profile on the device is removed upon logout, at which point the passkey would be required again to sign into the device.

If the local password is entered incorrectly three times, the passkey will be required again to sign in, after which a new local password can be created.

If no passkey exists on the phone, set up passkey on iCloud, on Android, or follow the YuibKey steps to set it up.

iOS

The minimum security requirement for iOS devices is that software must be no more than one major version behind the most recently released version of iOS, with a three-month grace period.

We recommend creating a passkey for all of your Netflix-issued devices, including cellphones and secondary desktops, that access Netflix resources. For iOS devices, these passkeys are required:

Okta Verify
A passkey on iCloud

Set up Okta Verify

Set up Okta Verify on one device using another device that already has Okta Verify enabled.

If you do not have Okta Verify set up on any other device, reference Set Up Okta Verify When No Other Device is Available.

Confirm that both of your devices have Bluetooth turned on.
Open the Okta Verify app on the device that is already set up.
Select the account and select Add Account to Another Device. A QR code and a setup code are displayed. Note the setup code for later.
Download the Okta Verify app from the relevant App Store on the new device.
1. For Android, download the Okta Verify app to your Work profile.
Open the Okta Verify app on the new device:
1. On a Windows or macOS device.
  1. Select Add Account.
  2. Enter the setup code from Step 2 on the new device. Another code will display.
  3. Enter the returned code on the device with Okta Verify already set up.
  4. Select Enable for Touch ID or Windows Hello confirmation.
2. On iOS or Android:
  1. Select Get Started and then select Next.
  2. Select Add account.
  3. Select Organization.
  4. Select Add account from another device.
  5. Select Scan QR code and scan the QR code. A setup code is displayed.
  6. Enter the setup code on the device with Okta Verify already set up.
  7. Select Got it and Allow for notifications.
  8. Select Enable to Enable screen lock confirmation.

Set up a passkey on iCloud

If iCloud was already being used and the same iCloud account is going to be used, there should already be a passkey stored in iCloud. Passkeys stored in iCloud are shared across all devices using the same iCloud account.

To create a passkey on iCloud:

On your iOS device, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up and Set up again.
When an iOS device is signed into iCloud, iOS automatically gives a Sign In prompt to store the passkey on the iCloud Keychain. Select Continue to do so.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Android

Note that only Google Pixels and some Samsung Enterprise Editions are supported. Its software must be no more than one major version behind the most recently released version of Android. When a new version is released, there is a three-month grace period to update to a supported version.

We recommend creating a passkey for all of your Netflix-issued devices, including cellphones and secondary desktops, that access Netflix resources. For Android devices, these passkeys are required:

Okta Verify
Security Key or Biometric

Android gives the option to set up either one or two profiles (personal and work). To set up just one Netflix (work) profile, use another phone with a saved passkey or a YubiKey.

Follow these steps, depending on your use case, to set up both Okta Verify and a security key or biometric.

Set up Android with one profile using another phone

These steps require another phone that has a passkey saved on it.

Set up the phone:#

Set up the phone and enter the Netflix email address when asked to Sign into an account.
Enter the Netflix email address again when asked to authenticate.
Select Use passkey or security key.
1. Note that this message might display:
  No passkeys available.
  There aren’t any passkeys saved for wic.prod.netflix.net on this device.
2. Select Use a different device to continue.
Select Use a different phone or tablet. A QR code will display.
Scan this QR code with the camera of the other phone.
1. Note that if the other phone is an Android and it has two profiles, the passkey might have to be scanned with the other profile.
Continue authenticating on the other phone.
Select Work if only a work profile is required.
1. Note that if Work is selected, a personal email account can still be added later, but a separate profile will not be created for it on the Android device. So both email accounts will be under one profile instead of being separated under Work and Personal profiles.
Install the Work apps and finish setting up the device.

Set up Okta Verify:#

Follow the steps in Okta Verify.

Set up a passkey for the new Android device:#

From your new Android device, go to go.netflix.com/newpasskey.
Authenticate using Okta FastPass.
Select Set up and Set up again.
Select This device when prompted to Choose a device for your passkey. This creates a passkey on the phone.
1. Note that if This device is not given as an option, check for any Android OS and Play Store updates or complete steps 6–9 from a device where Okta Verify is already set up, such as your primary laptop. At step 9, select Use a different phone, tablet or security key and scan the QR code with your Android device.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up Android with one profile using a YubiKey

A YubiKey allows an Android to be set up with a Netflix account during the initial setup.

If you have not set up your YubiKey as a passkey, refer to the Yubikey section for guidance, then complete these steps:

Set up phone:#

Enter your Netflix email at the Sign in prompt during the initial setup of the phone.
Enter your Netflix email when redirected to the Netflix authentication page and select Continue.
Select Use passkey or security key.
Note that this message might display:
1. No passkeys available
  There aren’t any passkeys saved for wic.prod.netflix.net on this device.
2. Select Use a different device to continue.
Select Use a different device.
Select USB security key.
Connect the YubiKey and tap it.
Enter the YubiKey PIN.
Tap the YubiKey again and select Continue.
Select Work if only a work profile is required.
1. Note that if Work is selected, a personal email account can still be added later, but a separate profile will not be created for it on the Android device. So both email accounts will be under one profile instead of being separated under Work and Personal profiles.
Install the work apps and finish setting up the device.

Set up Okta Verify:#

Follow the steps in Okta Verify.

Set up a passkey for the Android device:#

On your Android device, navigate to go.netflix.com/newpasskey.
Authenticate using Okta FastPass.
Select Set up and Set up again.
Select This device when prompted to Choose a device for your passkey. This creates a passkey on the phone.
1. Note that if This device is not given as an option, check for any Android OS and Play Store updates or complete steps 6–9 from a device where Okta Verify is already set up, such as your primary laptop. At step 9, select Use a different phone, tablet or security key and scan the QR code with your Android device.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up Android with one profile using a temporary email account

The only way to set up one profile on an Android device is either by having another phone with a passkey saved on it or by using a YubiKey. This is because signing into your Netflix account requires either Okta FastPass (Okta Verify), which is not yet installed, a passkey, or a YubiKey. Furthermore, Okta FastPass is downloaded from the Play store and downloads can only be done with a connected email account.

Due to this, our recommendation is to use a personal email or create a dummy email for the initial setup. Once the initial setup has been completed, and Okta Verify is downloaded and set up, the personal or dummy account can be removed. Follow these steps for a complete overview of the setup.

Set up the phone:#

Set up the phone using a personal or dummy email.

Set up Okta Verify:#

Follow the steps in Okta Verify.

Add a Netflix account:#

Add the Netflix account as an account on your Android device.
When prompted to select Okta FastPass or Okta Passkey or Security key, select Okta FastPass.
Follow the prompts on the screen and when prompted to select apps, select all, including Okta Verify. This creates the Work profile.
Set up Okta Verify on Work profile:
1. Repeat the steps in Okta Verify. Do not use the Okta Verify app found under the device’s personal profile. Instead, use another device to complete the setup.

Remove the personal account:#

Remove your personal account from your Android device. The phone will still show two profiles, but only the Work profile is now linked to an account.

Set up a passkey for the Android device:#

From your phone, go to go.netflix.com/newpasskey.
Authenticate using Okta FastPass.
Select Set up and Set up again.
Select This device when prompted to Choose a device for your passkey. This creates a passkey on the phone.
1. Note that if This device is not given as an option, check for any Android OS and Play Store updates or complete steps 6–9 from a device where Okta Verify is already set up, such as your primary laptop. At step 9, select Use a different phone, tablet or security key and scan the QR code with your Android device.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up Android with two profiles

Set up the phone:#

Set up the phone using a personal email.

Set up Okta Verify:#

Follow the steps in Okta Verify.

Add a Netflix account:#

Add the Netflix account as an account on your Android device.
When prompted to select Okta FastPass or Okta Passkey or Security key, select Okta FastPass.
Follow the prompts on the screen and when prompted to select apps, select all, including Okta Verify. This creates the Work profile.
Set up Okta Verify on Work profile:
1. Repeat the steps in Okta Verify. Do not use the Okta Verify app found under the device’s personal profile. Instead, use another device to complete the setup.

Set up a passkey for the Android device:#

From your phone, go to go.netflix.com/newpasskey.
Authenticate using Okta FastPass.
Select Set up and Set up again.
Select This device when prompted to Choose a device for your passkey. This creates a passkey on the phone.
1. Note that if This device is not given as an option, check for any Android OS and Play Store updates or complete steps 6–9 from a device where Okta Verify is already set up, such as your primary laptop. At step 9, select Use a different phone, tablet or security key and scan the QR code with your Android device.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up a passkey for Android device from the device itself

A passkey for an Android can be set up either directly from the Android device or from a computer. These steps explain how to create a passkey for an Android device from the device itself.

On your Android device, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up and Set up again.
Select This device when prompted to Choose a device for your passkey. This creates a passkey on the phone.
1. Note that if This device is not given as an option, check for any Android OS and Play Store updates or refer to section Set up a passkey for an existing Android device from a computer to create the passkey from a computer.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list

Set up a passkey for an Android device from a computer

A passkey for an Android can be set up either directly from the Android device or from a computer. These steps explain how to create a passkey for an Android device from a computer.

From your computer, go to go.netflix.com/newpasskey.
Authenticate using Okta FastPass.
Select Set up and Set up again.
Select Use a different phone, tablet or security key when prompted to Choose where to save your passkey for wic.prod.netflix.net.
Scan the QR code with the camera app of your Work profile.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up Okta Verify

Set up Okta Verify on one device using another device that already has Okta Verify enabled.

If you do not have Okta Verify set up on any other device, reference Set Up Okta Verify When No Other Device is Available.

Confirm that both of your devices have Bluetooth turned on.
Open the Okta Verify app on the device that is already set up.
Select the account and select Add Account to Another Device. A QR code and a setup code are displayed. Note the setup code for later.
Download the Okta Verify app from the relevant App Store on the new device.
1. For Android, download the Okta Verify app to your work profile.
Open the Okta Verify app on the new device:
1. On a Windows or macOS device:
  1. Select Add Account.
  2. Enter the setup code from Step 2 on the new device. Another code will display.
  3. Enter the returned code on the device with Okta Verify already set up.
  4. Select Enable for Touch ID or Windows Hello confirmation.
2. On iOS or Android:
  1. Select Get Started and then select Next.
  2. Select Add account.
  3. Select Organization.
  4. Select Add account from another device.
  5. Select Scan QR code and scan the QR code. A setup code is displayed.
  6. Enter the setup code on the device with Okta Verify already set up.
  7. Select Got it and Allow for notifications.
  8. Select Enable to Enable screen lock confirmation.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
The new authenticator is the most recently enrolled option on the list.

YubiKey

Regardless of the platform, the YubiKey must be a version that supports FIDO2, not U2F or the previous FIDO protocol. Series 5, the Security Key series including nano, and the YubiKey Bio series, support this.

Check a YubiKey’s version by visiting https://yubico.com/genuine.

Request a YubiKey from the Yubikey Order Form.

Set up a PIN for the YubiKey

The PIN for your YubiKey can be short and numeric (like your phone’s lock-screen PIN) or long (up to 64 characters) and complex, including letters and special characters. The most important thing is that the PIN is something you’ll remember!

Navigate to Settings in Chrome.
Select Privacy and security.
Select Security.
Select Manage security keys.
Select Create a PIN.
Follow the prompts to create a PIN for your YubiKey.

Add your YubiKey as a passkey

On your computer, navigate to go.netflix.com/newpasskey.
Authenticate using Okta Verify.
Select Set up, then Set up again.
If you’re on an Apple device, when a macOS device is signed into iCloud, macOS automatically gives a Sign In prompt to store the passkey on iCloud Keychain. Select Cancel to get more options for where to store the passkey.
At Choose where to save your passkey for wic.prod.netflix.net, select Use a different phone, tablet or security key to store the passkey on the YubiKey.
Enter the YubiKey PIN when prompted and select Next.
Tap the YubiKey when prompted.
Select Allow to let the site access your security key.
When the Security Methods list is returned, give the newly added authenticator a nickname so it’s easily identifiable.
1. The new authenticator is the most recently enrolled option on the list.

Set up Okta Verify when no other device is available

Set up Okta Verify on a laptop or desktop

Use this method only when Okta Verify is not set up on any device. This method requires a passkey to be set up on the device first.

If there is a device available with Okta Verify installed, then follow the steps in the Set up Okta Verify section for your specific device.

Open the Okta Verify app. If not installed, download the Okta Verify app from the relevant App Store.
Select Get Started.
Select Next.
Make sure the address is: wic.prod.netflix.net under New Account and select Next.
Authenticate when prompted.
Select Enable to enable Touch ID or Windows Hello.

Set up Okta Verify on a mobile phone

Use this method only when Okta Verify is not set up on any device. This method requires a passkey to be set up on the device first.

If there is a device available with Okta Verify installed, then follow the steps in the Set up Okta Verify section for your specific device.

Download the Okta Verify app from the relevant App Store.
1. For Android, download the Okta Verify app on the Work profile.
Open the Okta Verify app and select Add account.
Select Organization.
Select Skip at the Add account from another device? Prompt.
Select No, sign in instead at the Do you have your QR code? Prompt.
Select Next to continue using wic.prod.netflix.net as the Organization’s sign-in URL.
Enter the Netflix username at the Netflix Log in prompt and select Continue.
Authenticate when prompted at the Verify with passkey or security key prompt.

Add Okta Verify to Android:#

Authenticate at the Use your screen lock prompt.
Select Open Okta Verify.
At the Enable screen lock confirmation prompt, select Enable.
At the Account added prompt, select Done.

Add Okta Verify to iOS:#

At the Use Face ID to sign in? prompt, select Continue.
At the Enable Face ID or Passcode Confirmation prompt, select Enable.
At the Account Added prompt, select Done.

Remove Passkeys

Navigate to https://wic.prod.netflix.net/.
Select your Name, then Settings.
Under Security Methods, identify the device you'd like to remove from Okta Passwordless.
Select Remove.

Common Error Messages

No passkeys available.
There aren’t any passkeys saved for wic.prod.netflix.net on this device.

This error means that no passkey exists on the device. A passkey needs to be set up. Follow the steps in this article to create a passkey for that device.

The user attempted to register an authenticator that contains one of the credentials already registered with the relying party.

This error message means that a passkey has already been created for the selected method so the setup is complete and no further action is required.

The operation either timed out or was not allowed

This error message means that a passkey has not been created for the selected method. This error is usually returned when too much time has passed since the initiation of the process to create a passkey on the setup page. Restart the setup.

Something went wrong.

There was a problem saving your passkey.

This error message is returned in Windows when a passkey already exists for the selected method.

On Android: Devices Couldn't connect and on Windows: Something went wrong.

This error message happens when trying to create a passkey for Android from a Windows device. Often after a few attempts, passkey setup is successful. The solution is to create the Android passkey directly from the Android device itself. Follow the steps found in Set up passkey for an existing Android device.

Verification timed out. Please try again.

This error mostly occurs with Android devices when a connection cannot be established. Usually the connection is established after several attempts.

Can't add work profile - contact your IT admin.

This error mostly occurs on Android devices when a work profile fails to install. Resolve the issue by removing the work profile and then re-adding the Netflix account:
- Go to the phone’s Settings.
- Select Password, passkey & accounts.
- Select Remove work profile to completely remove the work profile.
- Return to Password, passkey & accounts, select Add account, and re-add the Netflix account.

If you have any feedback regarding the Passwordless initiative, share your thoughts with us at go.netflix.com/passwordless-feedback.

Agent facing Article

Troubleshoot Common Okta Passwordless Issues

To start enrollment in Okta Passwordless, visit go.netflix.com/oktaenroll.

To add new passkeys, visit Add a new passkey to your device article.

Follow these troubleshooting steps to resolve some common issues.

Failed to Scan QR Code in Okta Verify.

Enrollment with Android devices to scan QR codes is best used with the Pixel Camera, Google Camera, or QR Scanner. The application must be installed within the work profile if you have multiple profiles.

For iOS devices, use the native camera application to scan any QR code. For Android devices, the Pixel Camera, Google Camera, or QR Scanner from the work profile is required to scan QR codes.

The following errors are caused by using the Okta Verify application to enroll a new authentication method.

Android: Unrecognized QR code

iOS: Failed to scan QR code

Choose Where to Save This Passkey versus Create a Passkey Prompt

Windows users starting enrollment will notice the sample cards stating Create Passkey. When going through the actual enrollment, the Windows modal window will actually state Choose where to save this passkey. The verbiage is different, but the actions are the same. Users can proceed to save the iPhone, iPad, Android passkey or Security Key when prompted to.

Okta Verify app is not launching.

Open the application Activity Monitor, to confirm that Okta Verify is running.
If it's not open, open the application from the Application folder or Spotlight Search.
Check for the Okta Verify icon in your menu bar.
Select the icon and select Open.

For users without an extended monitor, Okta Verify can generally be found to the right of the camera notch, an area commonly referred to as the menu bar.

If you can't find the app, close out some other applications that are present in the menu bar or configure the scale of Okta Verify to always show in the menu bar. Users with extended screens should be able to find the app in the menu bar going forward.

Okta Verify: Error: Connection Issue when adding mobile device.

Set up Okta Verify on the mobile device separately.
Open Okta Verify on your mobile device.
Select Add account.
Select Organization.
Select Skip.
Select No, sign in instead.
Enter the URL: wic.prod.netflix.net
Follow prompts to sign in and authenticate with your passkey.
- If this is an Android device, it may show "no passkey available," which means you need to switch profiles.

Okta Verify: Localhost Error.

Users (especially engineers) may see a localhost error similar to localhost sent an invalid response or localhost took too long to respond. This is caused by the browser caching the HSTS setting for the localhost domain. Follow the steps below to clear the cache.

Visit chrome://net-internals/#hsts in your Chrome browser.
Under Delete domain security policies, enter localhost and press Delete.
Connect to Okta Verify.

Okta Verify on macOS: Touch ID or password settings out of sync.

On macOS, you may see an error in Okta Verify that states Touch ID or password settings out of sync with Okta Verify; this could mean that a new fingerprint for Touch ID was registered on your computer and has not synced with Okta Verify. If so, please follow these steps to resolve:

If you are using iCloud:

Confirm the Passwords and Keychain setting is turned on:
1. From your Apple device, open System Settings, select your name, then choose iCloud.
2. Verify Passwords and Keychain is set to On.
Restart your mobile device

If enrolled in Okta Verify:

Remove your Netflix Account from Okta Verify on all devices.

If you see the error noted earlier:

Select Update.
Okta Verify will state to check your browser and open a new tab or window prompting you to authenticate with your fingerprint; please proceed to authenticate.
1. When successfully authenticated, Okta Verify will state Touch ID confirmation enabled and the error message will no longer appear.

The authentication prompt is looping.

Check and disable your adblocker, if it’s enabled.

Use this guide to turn off Chrome's ad blocker.

This site can't provide a secure connection.

Copy and paste chrome://net-internals/#hsts into your browser.
Under Delete domain security policies, enter localhost and select Delete.

Google Device Policy Sync Error: Tap to regain work access

Remove the Okta Verify mobile app that was installed from the Apple Store and install it from the Google Device Policy app.

Open the Google Device Policy app on your mobile device.
Select ≡
Select Apps.
Select Install for Okta Verify.

Linux: Authentication window hangs when adding a YubiKey.

Retry adding the YubiKey and wait a few minutes.
Check your bluetooth settings. Some configurations may delay the authentication process.
Keep the mobile device close to the computer and if possible, remove the case.
Reboot the mobile device.
If using an external bluetooth adapter, try another adapter if available.

Linux: Enrolled YubiKey no longer registers

An enrolled YubiKey is met with the error:

This operation either timed out or was not allowed.

Reset the YubiKey to factory settings and program a new PIN and fingerprint using the authenticator app for Linux.
Re-enroll the YubiKey as a passkey from go.netflix.com/newpasskey

Duo Authentication May Appear Even Though You've Enrolled in

You may be prompted with a Duo authentication window when attempting to log in to a Netflix application (i.e., Whitepages) if you have just enrolled in passwordless or if you have been enrolled for some time.

If you encounter this, refresh the page where the Duo authentication window appears, and you should be prompted to use one of your passkeys or the desired application will load.

Passwordless. iCloud KeyChain Doesn't Show as an Option for

Enrollment.

iCloud Keychain on your macOS and iOS devices will need to be signed into AppleID and have certain settings applied in order for iCloud Keychain to become a selectable option. Your macOS will need to be on the latest version. Follow the steps here to update your macOS.

To enable iCloud Keychain settings on your Mac, follow the steps below.

On your Mac, visit System Settings.
Select your AppleID.
Select Sign-in & Security.
Select Two-factor Authentication
Set to On if it's not already.
Press back to Apple ID and select iCloud and ensure that Passwords & Keychain to On.
In the same setting, click into Passwords & Keychain and confirm that Sync this Mac set to On.
Repeat the same exact steps on your iPhone.
Revisit go.netflix.com/oktaenroll to start the enrollment workflow.

The AutoFill Passwords and Passkeys option is disabled.

When setting up a mobile passkey for your iOS device, you may be directed to the Password Options menu. Follow these steps:

Visit Settings.
Select Passwords.
If prompted, authenticate with your Face ID or passcode.
Select Password Options.
Set AutoFill Passwords and Passkeys to On.

Samsung: Google could not verify that this account belongs to you

Navigate to Settings, then Google and Google Services.
Select Work profile.
Select Autofill password and enable Use autofill with Google.

Arc Browser

The Arc browser is not supported for Okta. You can see the supported platforms, browsers, and operating systems here.

Arc is not supported by Okta at this moment. You'll be unable to utilize TouchID or Webauthn passkeys. Currently, Google Chrome and Safari (v 15.4 or later, on macOS 12.3.1 or later) support Apple Touch ID as a WebAuthN factor and can be used to log into Okta. After enrolling only into WebAuthN using Apple Touch ID, if users use browsers other than Chrome on MacOS, they may get a browser pop-up asking them to insert the Security Key.You can try using a security key instead so you can just tap the key instead of using mobile. Place an order at go.netflix.com/yubikeyrequest.

If you don't see your issue here, reach out to #ntech-help for further support.

If you have any feedback regarding the Passwordless initiative, share your thoughts with us at go.netflix.com/passwordless-feedback.

Agent facing Article

Support and Administer Okta Passwordless

See this article already transposed