diff --git a/resources/js/Layouts/Auth/AuthCard.vue b/resources/js/Layouts/Auth/AuthCard.vue
index 5fb1eff55..6a2aded66 100644
--- a/resources/js/Layouts/Auth/AuthCard.vue
+++ b/resources/js/Layouts/Auth/AuthCard.vue
@@ -1,6 +1,10 @@
 <script setup lang="ts">
     import { config } from "@/utils/config";
     import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from "@/components/ui/card";
+
+    defineProps<{
+        empty?: boolean,
+    }>();
 </script>
 
 <template>
@@ -18,7 +22,7 @@
                 </CardDescription>
             </template>
         </CardHeader>
-        <CardContent>
+        <CardContent :class="empty ? 'p-0' : ''">
             <slot />
         </CardContent>
         <CardFooter>
diff --git a/resources/js/Pages/Auth/Login.vue b/resources/js/Pages/Auth/Login.vue
index 3fa88e9b3..cf36e9494 100644
--- a/resources/js/Pages/Auth/Login.vue
+++ b/resources/js/Pages/Auth/Login.vue
@@ -15,14 +15,11 @@
     import { FormItem } from "@/components/ui/form";
     import { Check } from "lucide-vue-next";
     import TemplateRenderer from "@/components/TemplateRenderer.vue";
-    import { onMounted } from "vue";
     import {
-        startAuthentication,
         browserSupportsWebAuthn,
-        browserSupportsWebAuthnAutofill
     } from "@simplewebauthn/browser";
-    import { api } from "@/api/api";
     import { Separator } from "@/components/ui/separator";
+    import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
 
     const props = defineProps<{
         loginIsEmail: boolean,
@@ -42,38 +39,8 @@
         supports_passkeys: browserSupportsWebAuthn(),
     });
 
-    const passkeyForm = useForm({
-        remember: false,
-        start_authentication_response: '',
-    });
-
-    async function loginWithPasskey(autofill = false) {
-        try {
-            const response = await api.get(route('passkeys.authentication_options'), {
-                ignoreContentType: true,
-            });
-
-            const authenticationOptions = response.data;
-            const authenticationResponse = await startAuthentication({
-                optionsJSON: authenticationOptions,
-                useBrowserAutofill: autofill,
-            });
-
-            console.log(authenticationResponse);
-
-            passkeyForm.remember = form.remember;
-            passkeyForm.start_authentication_response = JSON.stringify(authenticationResponse);
-
-            passkeyForm.post(route('passkeys.login'));
-        } catch (error) {
-            console.error(error);
-        }
-    }
-
-    onMounted(async () => {
-        if(config('sharp.auth.passkeys.enabled') && await browserSupportsWebAuthnAutofill()) {
-            await loginWithPasskey(true);
-        }
+    const { loginWithPasskey } = usePasskeyLogin({
+        autofill: config('sharp.auth.passkeys.enabled'),
     });
 </script>
 
@@ -161,7 +128,7 @@
                                 type="button"
                                 variant="outline"
                                 class="w-full"
-                                @click="loginWithPasskey()"
+                                @click="loginWithPasskey({ remember: form.remember })"
                             >
                                 {{ __('sharp::pages/auth/login.passkey_button') }}
                             </Button>
diff --git a/resources/js/Pages/Auth/Login2Fa.vue b/resources/js/Pages/Auth/Login2Fa.vue
deleted file mode 100644
index 447090b99..000000000
--- a/resources/js/Pages/Auth/Login2Fa.vue
+++ /dev/null
@@ -1,59 +0,0 @@
-<script setup lang="ts">
-    import AuthLayout from "@/Layouts/Auth/AuthLayout.vue";
-    import { useForm } from "@inertiajs/vue3";
-    import { __ } from "@/utils/i18n";
-    import Title from "@/components/Title.vue";
-    import { route } from "@/utils/url";
-    import { Button } from "@/components/ui/button";
-    import { Alert, AlertDescription } from "@/components/ui/alert";
-    import AuthCard from "@/Layouts/Auth/AuthCard.vue";
-    import { Label } from "@/components/ui/label";
-    import { Input } from "@/components/ui/input";
-    import { FormItem, FormMessage } from "@/components/ui/form";
-
-    defineProps<{
-        helpText: string
-    }>();
-
-    const form = useForm({
-        code: '',
-    });
-</script>
-
-<template>
-    <AuthLayout>
-        <Title>
-            {{ __('sharp::pages/auth/login.title') }}
-        </Title>
-
-        <template v-if="form.hasErrors">
-            <Alert class="mb-4" variant="destructive">
-                <AlertDescription>
-                    {{ Object.values(form.errors)[0] }}
-                </AlertDescription>
-            </Alert>
-        </template>
-
-        <form @submit.prevent="form.post(route('code16.sharp.login.2fa.post'))">
-            <AuthCard>
-                <template #title>
-                    {{ __('sharp::pages/auth/login.title') }}
-                </template>
-                <template v-if="helpText" #description>
-                    <div class="space-y-2" v-html="helpText"></div>
-                </template>
-                <FormItem>
-                    <Label for="code">
-                        {{ __('sharp::pages/auth/login.code_field') }}
-                    </Label>
-                    <Input type="text" id="code" v-model="form.code" />
-                </FormItem>
-                <template #footer>
-                    <Button type="submit" class="w-full">
-                        {{ __('sharp::pages/auth/login.button') }}
-                    </Button>
-                </template>
-            </AuthCard>
-        </form>
-    </AuthLayout>
-</template>
diff --git a/resources/js/Pages/Auth/LoginMultiFactor.vue b/resources/js/Pages/Auth/LoginMultiFactor.vue
new file mode 100644
index 000000000..a3a79dffe
--- /dev/null
+++ b/resources/js/Pages/Auth/LoginMultiFactor.vue
@@ -0,0 +1,76 @@
+<script setup lang="ts">
+    import AuthLayout from "@/Layouts/Auth/AuthLayout.vue";
+    import { useForm } from "@inertiajs/vue3";
+    import { __ } from "@/utils/i18n";
+    import Title from "@/components/Title.vue";
+    import { route } from "@/utils/url";
+    import { Button } from "@/components/ui/button";
+    import { Alert, AlertTitle } from "@/components/ui/alert";
+    import AuthCard from "@/Layouts/Auth/AuthCard.vue";
+    import { Label } from "@/components/ui/label";
+    import { Input } from "@/components/ui/input";
+    import { FormItem } from "@/components/ui/form";
+    import { MultiFactorMethod } from "@/types";
+    import { usePasskeyLogin } from "@/Pages/Auth/usePasskeyLogin";
+
+    const props = defineProps<{
+        method: MultiFactorMethod,
+        helpText: string,
+        passkeyError: string,
+        errors: Record<string, string>,
+    }>();
+
+    const form = useForm({
+        code: '',
+    });
+
+    const { loginWithPasskey } = usePasskeyLogin({ autofill: props.method === 'passkey' });
+</script>
+
+<template>
+    <AuthLayout>
+        <Title>
+            {{ __('sharp::pages/auth/login.title') }}
+        </Title>
+
+        <template v-if="Object.keys(errors).length || passkeyError">
+            <Alert class="mb-4" variant="destructive">
+                <AlertTitle class="mb-0">
+                    {{ Object.values(errors)[0] || passkeyError }}
+                </AlertTitle>
+            </Alert>
+        </template>
+
+        <form @submit.prevent="method === 'passkey' ? loginWithPasskey() : form.post(route('code16.sharp.login.2fa.post'))">
+            <AuthCard :empty="method == 'passkey'">
+                <template #title>
+                    {{ __('sharp::pages/auth/login.title') }}
+                </template>
+                <template v-if="helpText" #description>
+                    <div class="space-y-2" v-html="helpText"></div>
+                </template>
+                <template v-if="method == 'passkey'">
+                    <input class="sr-only" autocomplete="webauthn"></input>
+                </template>
+                <template v-else>
+                    <FormItem>
+                        <Label for="code">
+                            {{ __('sharp::pages/auth/login.code_field') }}
+                        </Label>
+                        <Input type="text" id="code" v-model="form.code" />
+                    </FormItem>
+                </template>
+                <template #footer>
+                    <Button type="submit" class="w-full">
+                        <template v-if="method === 'passkey'">
+                            {{ __('sharp::pages/auth/login.passkey_button') }}
+                        </template>
+                        <template v-else>
+                            {{ __('sharp::pages/auth/login.button') }}
+                        </template>
+                    </Button>
+                </template>
+            </AuthCard>
+        </form>
+    </AuthLayout>
+</template>
diff --git a/resources/js/Pages/Auth/Passkeys/Create.vue b/resources/js/Pages/Auth/Passkeys/Create.vue
index 6526bc83f..6d2540df2 100644
--- a/resources/js/Pages/Auth/Passkeys/Create.vue
+++ b/resources/js/Pages/Auth/Passkeys/Create.vue
@@ -11,40 +11,15 @@
     import { startRegistration } from "@simplewebauthn/browser";
     import { api } from "@/api/api";
     import { Field, FieldDescription, FieldError, FieldGroup, FieldLabel } from "@/components/ui/field";
+    import { usePasskeyRegister } from "@/Pages/Auth/usePasskeyRegister";
 
-    const props = defineProps<{
+    defineProps<{
         prompt: boolean,
+        isMultiFactor: boolean,
         cancelUrl: string,
     }>();
 
-    const form = useForm({
-        name: '',
-        passkey: '',
-    });
-
-    async function submit() {
-        form.clearErrors();
-
-        try {
-            const optionsResponse = await api.post(route('code16.sharp.passkeys.validate'), {
-                name: form.name,
-            });
-
-            const registrationResponse = await startRegistration({
-                optionsJSON: optionsResponse.data.passkeyOptions,
-            });
-
-            form.passkey = JSON.stringify(registrationResponse);
-
-            form.post(route('code16.sharp.passkeys.store'));
-        } catch (error) {
-            if (error.response?.status === 422) {
-                form.setError({ name: error.response.data.errors?.name?.[0] });
-            } else {
-                console.error(error);
-            }
-        }
-    }
+    const { form, registerPasskey } = usePasskeyRegister();
 </script>
 
 <template>
@@ -53,7 +28,7 @@
             {{ __('sharp::pages/auth/passkeys.title') }}
         </Title>
 
-        <form @submit.prevent="submit">
+        <form @submit.prevent="registerPasskey()">
             <AuthCard>
                 <template #title>
                     {{ __('sharp::pages/auth/passkeys.title') }}
@@ -88,39 +63,45 @@
 
                 <template #footer>
                     <div class="grid gap-2 w-full">
-                        <Button type="submit" class="w-full" :disabled="form.processing">
-                            {{ prompt ? __('sharp::pages/auth/passkeys.prompt_version.button') : __('sharp::pages/auth/passkeys.account_version.button') }}
-                        </Button>
-
-                        <template v-if="prompt">
-                            <Button
-                                type="button"
-                                variant="outline"
-                                class="w-full"
-                                as="a"
-                                :href="route('code16.sharp.home')"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.prompt_version.skip_prompt_button') }}
-                            </Button>
-                            <Button
-                                type="button"
-                                variant="ghost"
-                                class="w-full"
-                                @click="useForm({}).post(route('code16.sharp.passkeys.skip-prompt'))"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.prompt_version.never_ask_again_button') }}
+                        <template v-if="isMultiFactor">
+                            <Button type="submit" class="w-full" :disabled="form.processing">
+                                {{ __('sharp::pages/auth/passkeys.prompt_version.button')  }}
                             </Button>
                         </template>
                         <template v-else>
-                            <Button
-                                type="button"
-                                variant="ghost"
-                                class="w-full"
-                                as="a"
-                                :href="cancelUrl"
-                            >
-                                {{ __('sharp::pages/auth/passkeys.account_version.cancel_button') }}
+                            <Button type="submit" class="w-full" :disabled="form.processing">
+                                {{ prompt ? __('sharp::pages/auth/passkeys.prompt_version.button') : __('sharp::pages/auth/passkeys.account_version.button') }}
                             </Button>
+                            <template v-if="prompt">
+                                <Button
+                                    type="button"
+                                    variant="outline"
+                                    class="w-full"
+                                    as="a"
+                                    :href="route('code16.sharp.home')"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.prompt_version.skip_prompt_button') }}
+                                </Button>
+                                <Button
+                                    type="button"
+                                    variant="ghost"
+                                    class="w-full"
+                                    @click="useForm({}).post(route('code16.sharp.passkeys.skip-prompt'))"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.prompt_version.never_ask_again_button') }}
+                                </Button>
+                            </template>
+                            <template v-else>
+                                <Button
+                                    type="button"
+                                    variant="ghost"
+                                    class="w-full"
+                                    as="a"
+                                    :href="cancelUrl"
+                                >
+                                    {{ __('sharp::pages/auth/passkeys.account_version.cancel_button') }}
+                                </Button>
+                            </template>
                         </template>
                     </div>
                 </template>
diff --git a/resources/js/Pages/Auth/usePasskeyLogin.ts b/resources/js/Pages/Auth/usePasskeyLogin.ts
new file mode 100644
index 000000000..af3713d2b
--- /dev/null
+++ b/resources/js/Pages/Auth/usePasskeyLogin.ts
@@ -0,0 +1,53 @@
+import { useForm } from "@inertiajs/vue3";
+import { api } from "@/api/api";
+import { route } from "@/utils/url";
+import { browserSupportsWebAuthnAutofill, startAuthentication } from "@simplewebauthn/browser";
+import { onMounted } from "vue";
+
+type PasskeyLoginOptions = {
+    autofill?: boolean;
+}
+
+export function usePasskeyLogin(options: PasskeyLoginOptions) {
+    return useSpatiePasskeyLogin(options);
+}
+
+function useSpatiePasskeyLogin(options: PasskeyLoginOptions) {
+    const passkeyForm = useForm({
+        remember: false,
+        start_authentication_response: '',
+    });
+
+    async function loginWithPasskey({ autofill = false, remember = false } = {}) {
+        try {
+            const response = await api.get(route('passkeys.authentication_options'), {
+                ignoreContentType: true,
+            });
+
+            const authenticationOptions = response.data;
+            const authenticationResponse = await startAuthentication({
+                optionsJSON: authenticationOptions,
+                useBrowserAutofill: autofill,
+            });
+
+            passkeyForm.remember = remember;
+            passkeyForm.start_authentication_response = JSON.stringify(authenticationResponse);
+
+            passkeyForm.post(route('passkeys.login'), {
+                headers: {
+                    'X-Sharp': '1',
+                },
+            });
+        } catch (error) {
+            console.error(error);
+        }
+    }
+
+    if(options.autofill && browserSupportsWebAuthnAutofill()) {
+        onMounted(() => {
+            loginWithPasskey({ autofill: true });
+        })
+    }
+
+    return { loginWithPasskey }
+}
diff --git a/resources/js/Pages/Auth/usePasskeyRegister.ts b/resources/js/Pages/Auth/usePasskeyRegister.ts
new file mode 100644
index 000000000..13074bb15
--- /dev/null
+++ b/resources/js/Pages/Auth/usePasskeyRegister.ts
@@ -0,0 +1,41 @@
+import { useForm } from "@inertiajs/vue3";
+import { api } from "@/api/api";
+import { route } from "@/utils/url";
+import { startRegistration } from "@simplewebauthn/browser";
+
+export function usePasskeyRegister() {
+    return useSpatiePasskeyRegister();
+}
+
+function useSpatiePasskeyRegister() {
+    const form = useForm({
+        name: '',
+        passkey: '',
+    });
+
+    async function registerPasskey() {
+        form.clearErrors();
+
+        try {
+            const optionsResponse = await api.post(route('code16.sharp.passkeys.spatie.validate'), {
+                name: form.name,
+            });
+
+            const registrationResponse = await startRegistration({
+                optionsJSON: optionsResponse.data.passkeyOptions,
+            });
+
+            form.passkey = JSON.stringify(registrationResponse);
+
+            form.post(route('code16.sharp.passkeys.spatie.store'));
+        } catch (error: any) {
+            if (error.response?.status === 422) {
+                form.setError({ name: error.response.data.errors?.name?.[0] });
+            } else {
+                console.error(error);
+            }
+        }
+    }
+
+    return { form, registerPasskey }
+}
diff --git a/resources/js/components/ui/alert/AlertTitle.vue b/resources/js/components/ui/alert/AlertTitle.vue
index 7b2f5f1b5..f228dd8e8 100644
--- a/resources/js/components/ui/alert/AlertTitle.vue
+++ b/resources/js/components/ui/alert/AlertTitle.vue
@@ -8,7 +8,7 @@ const props = defineProps<{
 </script>
 
 <template>
-  <h5 :class="cn('mb-1 font-medium leading-none tracking-tight', props.class)">
+  <h5 :class="cn('mb-1 font-medium leading-tight tracking-tight', props.class)">
     <slot />
   </h5>
 </template>
diff --git a/resources/js/types/generated.d.ts b/resources/js/types/generated.d.ts
index 35bb75464..01a62114b 100644
--- a/resources/js/types/generated.d.ts
+++ b/resources/js/types/generated.d.ts
@@ -641,7 +641,6 @@ export type FormUploadFieldData = {
   type: "upload";
   imageCropRatio: [number, number];
   imageTransformable: boolean;
-  imageCompactThumbnail: boolean;
   imageTransformKeepOriginal: boolean | null;
   imageTransformableFileTypes: Array<string> | null;
   allowedExtensions: Array<string> | null;
@@ -748,6 +747,7 @@ export type MenuItemData = {
   isCollapsible: boolean;
   openInNewTab: boolean;
 };
+export type MultiFactorMethod = "notification" | "totp" | "passkey";
 export type NotificationData = {
   title: string;
   level: NotificationLevel;
diff --git a/resources/js/types/routes.d.ts b/resources/js/types/routes.d.ts
index 5ad19cb2d..4ae15a510 100644
--- a/resources/js/types/routes.d.ts
+++ b/resources/js/types/routes.d.ts
@@ -579,9 +579,11 @@ declare module 'ziggy-js' {
     ],
     "code16.sharp.password.reset.post": [],
     "code16.sharp.passkeys.create": [],
-    "code16.sharp.passkeys.validate": [],
-    "code16.sharp.passkeys.store": [],
-    "code16.sharp.passkeys.skip-prompt": []
+    "code16.sharp.passkeys.spatie.validate": [],
+    "code16.sharp.passkeys.spatie.store": [],
+    "code16.sharp.passkeys.registered": [],
+    "code16.sharp.passkeys.skip-prompt": [],
+    "code16.sharp.passkeys.authenticated": []
 }
 }
 export {};
diff --git a/resources/lang/en/auth.php b/resources/lang/en/auth.php
index acf794310..32a7de9be 100644
--- a/resources/lang/en/auth.php
+++ b/resources/lang/en/auth.php
@@ -27,6 +27,10 @@
                 ],
             ],
         ],
+        'passkey' => [
+            'form_help_text' => 'Please click on the button below to use one of your passkey for :email account.',
+            'mismatch_error' => 'The passkey used is linked to a different account.',
+        ],
     ],
     'passkeys' => [
         'entity_label' => 'Passkey',
diff --git a/resources/lang/fr/auth.php b/resources/lang/fr/auth.php
index 74b76b268..bdd17b089 100644
--- a/resources/lang/fr/auth.php
+++ b/resources/lang/fr/auth.php
@@ -27,6 +27,10 @@
                 ],
             ],
         ],
+        'passkey' => [
+            'form_help_text' => 'Veuillez cliquer sur le bouton ci-dessous pour utiliser une clé d’accès associé au compte :email',
+            'mismatch_error' => 'La clé d’accès utilisée est associée à un autre compte.',
+        ],
     ],
     'passkeys' => [
         'entity_label' => 'Clé d’accès',
diff --git a/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php b/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
index c7bfe6bf0..5902f5644 100644
--- a/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
+++ b/src/Auth/Impersonate/SharpDefaultEloquentImpersonationHandler.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Auth\Impersonate;
 
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Support\Facades\Gate;
 
 class SharpDefaultEloquentImpersonationHandler extends SharpImpersonationHandler
@@ -20,7 +21,7 @@ public function getUsers(): array
                 Gate::has('viewSharp'),
                 fn ($users) => $users->filter(fn ($user) => Gate::forUser($user)->allows('viewSharp'))
             )
-            ->mapWithKeys(fn ($user) => [$user->id => $user->$loginAttribute])
+            ->mapWithKeys(fn (Authenticatable $user) => [$user->getAuthIdentifier() => $user->$loginAttribute])
             ->all();
     }
 }
diff --git a/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php b/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
index 738a6f3ce..2f2001fc2 100644
--- a/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
+++ b/src/Auth/Passkeys/Commands/UpdatePasskeyNameCommand.php
@@ -2,10 +2,10 @@
 
 namespace Code16\Sharp\Auth\Passkeys\Commands;
 
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\EntityList\Commands\InstanceCommand;
 use Code16\Sharp\Form\Fields\SharpFormTextField;
 use Code16\Sharp\Utils\Fields\FieldsContainer;
-use Spatie\LaravelPasskeys\Models\Passkey;
 
 class UpdatePasskeyNameCommand extends InstanceCommand
 {
@@ -25,7 +25,7 @@ public function buildFormFields(FieldsContainer $formFields): void
     protected function initialData(mixed $instanceId): array
     {
         return [
-            'name' => Passkey::findOrFail($instanceId)->name,
+            'name' => app(PasskeyManager::class)->model()::findOrFail($instanceId)->name,
         ];
     }
 
@@ -35,7 +35,7 @@ public function execute(mixed $instanceId, array $data = []): array
             'name' => 'required',
         ]);
 
-        Passkey::findOrFail($instanceId)->update([
+        app(PasskeyManager::class)->model()::findOrFail($instanceId)->update([
             'name' => $data['name'],
         ]);
 
diff --git a/src/Auth/Passkeys/Entity/PasskeyList.php b/src/Auth/Passkeys/Entity/PasskeyList.php
index a90c418e3..f7b4f69eb 100644
--- a/src/Auth/Passkeys/Entity/PasskeyList.php
+++ b/src/Auth/Passkeys/Entity/PasskeyList.php
@@ -3,15 +3,14 @@
 namespace Code16\Sharp\Auth\Passkeys\Entity;
 
 use Code16\Sharp\Auth\Passkeys\Commands\UpdatePasskeyNameCommand;
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\EntityList\Commands\EntityCommand;
 use Code16\Sharp\EntityList\Fields\EntityListBadgeField;
 use Code16\Sharp\EntityList\Fields\EntityListField;
 use Code16\Sharp\EntityList\Fields\EntityListFieldsContainer;
 use Code16\Sharp\EntityList\SharpEntityList;
-use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Contracts\Support\Arrayable;
 use Illuminate\Database\Eloquent\Model;
-use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
 
 class PasskeyList extends SharpEntityList
 {
@@ -70,14 +69,16 @@ public function getInstanceCommands(): ?array
 
     public function delete(mixed $id): void
     {
-        $this->currentUser()->passKeys()->findOrFail($id)->delete();
+        app(PasskeyManager::class)->userPasskeys(auth()->user())->findOrFail($id)->delete();
     }
 
     public function getListData(): array|Arrayable
     {
+        $lastUsedPasskey = app(PasskeyManager::class)->getLastUsedPasskey();
+
         return $this
-            ->setCustomTransformer('usage', function ($value, Model $passkey) {
-                return $passkey->getKey() == request()->cookie('sharp_last_used_passkey')
+            ->setCustomTransformer('usage', function ($value, Model $passkey) use ($lastUsedPasskey) {
+                return $passkey->is($lastUsedPasskey)
                     ? trans('sharp::auth.passkeys.list.used_in_this_browser_badge')
                     : null;
             })
@@ -88,15 +89,7 @@ public function getListData(): array|Arrayable
                 return $passkey->created_at?->isoFormat('LLL');
             })
             ->transform(
-                $this->currentUser()->passkeys()->orderByDesc('created_at')->get()
+                app(PasskeyManager::class)->userPasskeys(auth()->user())->orderByDesc('created_at')->get()
             );
     }
-
-    protected function currentUser(): Authenticatable&HasPasskeys
-    {
-        /** @var Authenticatable&HasPasskeys $user */
-        $user = auth()->user();
-
-        return $user;
-    }
 }
diff --git a/src/Auth/Passkeys/PasskeyEventSubscriber.php b/src/Auth/Passkeys/PasskeyEventSubscriber.php
deleted file mode 100644
index 9ee0c4943..000000000
--- a/src/Auth/Passkeys/PasskeyEventSubscriber.php
+++ /dev/null
@@ -1,17 +0,0 @@
-<?php
-
-namespace Code16\Sharp\Auth\Passkeys;
-
-use Illuminate\Events\Dispatcher;
-use Illuminate\Support\Facades\Cookie;
-use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
-
-class PasskeyEventSubscriber
-{
-    public function subscribe(Dispatcher $events): void
-    {
-        $events->listen(PasskeyUsedToAuthenticateEvent::class, function (PasskeyUsedToAuthenticateEvent $event) {
-            Cookie::queue('sharp_last_used_passkey', $event->passkey->id, 576000);
-        });
-    }
-}
diff --git a/src/Auth/Passkeys/PasskeyManager.php b/src/Auth/Passkeys/PasskeyManager.php
new file mode 100644
index 000000000..30c360d41
--- /dev/null
+++ b/src/Auth/Passkeys/PasskeyManager.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Code16\Sharp\Auth\Passkeys;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Events\Dispatcher;
+
+/**
+ * @template TModel of Model
+ */
+interface PasskeyManager
+{
+    public function isEnabled(): bool;
+
+    /**
+     * @param  TModel  $passkey
+     */
+    public function setLastUsedPasskey(Model $passkey): void;
+
+    /**
+     * @return TModel|null
+     */
+    public function getLastUsedPasskey(): ?Model;
+
+    public function getErrorMessage(): ?string;
+
+    public function setRedirectUrl(): void;
+
+    public function userPasskeys(Authenticatable $user): Builder;
+
+    public function userHasPasskey(Authenticatable $user): bool;
+
+    /**
+     * @return class-string<TModel>
+     */
+    public function model(): string;
+
+    public function subscribe(Dispatcher $events): void;
+}
diff --git a/src/Auth/Passkeys/SpatiePasskeyManager.php b/src/Auth/Passkeys/SpatiePasskeyManager.php
new file mode 100644
index 000000000..39bba8a78
--- /dev/null
+++ b/src/Auth/Passkeys/SpatiePasskeyManager.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace Code16\Sharp\Auth\Passkeys;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Contracts\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Support\Facades\Cookie;
+use Illuminate\Support\Facades\Redirect;
+use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
+use Spatie\LaravelPasskeys\Models\Passkey;
+use Spatie\LaravelPasskeys\Support\Config;
+
+/**
+ * @implements PasskeyManager<Passkey>
+ */
+class SpatiePasskeyManager implements PasskeyManager
+{
+    public function isEnabled(): bool
+    {
+        return (bool) sharp()->config()->get('auth.passkeys.enabled');
+    }
+
+    public function setLastUsedPasskey(Model $passkey): void
+    {
+        Cookie::queue('sharp_last_used_passkey', $passkey->getKey(), 576000);
+    }
+
+    public function getLastUsedPasskey(): ?Model
+    {
+        return $this->model()::find(Cookie::get('sharp_last_used_passkey'));
+    }
+
+    public function getErrorMessage(): ?string
+    {
+        return session('authenticatePasskey::message');
+    }
+
+    public function setRedirectUrl(): void
+    {
+        $intendedUrl = Redirect::intended(
+            route('code16.sharp.home', [
+                'globalFilter' => sharp()->context()->globalFilterUrlSegmentValue(),
+            ])
+        )->getTargetUrl();
+
+        config()->set(
+            'passkeys.redirect_to_after_login',
+            route('code16.sharp.passkeys.authenticated', [
+                'intended_url' => $intendedUrl,
+            ])
+        );
+    }
+
+    public function userPasskeys(Authenticatable $user): Builder
+    {
+        return $user->passkeys();
+    }
+
+    public function userHasPasskey(Authenticatable $user): bool
+    {
+        return $user->passkeys()->exists();
+    }
+
+    public function model(): string
+    {
+        return Config::getPassKeyModel();
+    }
+
+    public function subscribe(Dispatcher $events): void
+    {
+        $events->listen(function (PasskeyUsedToAuthenticateEvent $event) {
+            if ($event->request->headers->has('X-Sharp')) {
+                $this->setLastUsedPasskey($event->passkey);
+                $this->setRedirectUrl();
+            }
+        });
+    }
+}
diff --git a/src/Auth/TwoFactor/MultiFactorManager.php b/src/Auth/TwoFactor/MultiFactorManager.php
new file mode 100644
index 000000000..e3e0c7720
--- /dev/null
+++ b/src/Auth/TwoFactor/MultiFactorManager.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace Code16\Sharp\Auth\TwoFactor;
+
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Auth;
+
+class MultiFactorManager
+{
+    public function isEnabled(): bool
+    {
+        return sharp()->config()->get('auth.2fa.enabled');
+    }
+
+    public function currentMethod(): ?MultiFactorMethod
+    {
+        return $this->currentHandler()?->method();
+    }
+
+    public function currentHandler(): ?Sharp2faHandler
+    {
+        return app(Sharp2faHandler::class);
+    }
+
+    public function currentHandlerHelpText(): ?string
+    {
+        return method_exists($this->currentHandler(), 'formHelpText')
+            ? $this->currentHandler()->setUser($this->pendingUser())->formHelpText()
+            : trans('sharp::auth.2fa.form_help_text');
+    }
+
+    public function isUsingPasskeyMethod(): bool
+    {
+        return $this->isEnabled()
+            && $this->currentMethod() === MultiFactorMethod::Passkey
+            && $this->currentHandler()->isExpectingLogin();
+    }
+
+    public function pendingUser(): ?Authenticatable
+    {
+        if ($userId = $this->currentHandler()?->userId()) {
+            return $this->findUser($userId);
+        }
+
+        return null;
+    }
+
+    protected function findUser($id): ?Authenticatable
+    {
+        return once(function () use ($id) {
+            $user = Auth::guard(sharp()->config()->get('auth.guard'))
+                ->onceUsingId($id);
+            Auth::forgetGuards();
+
+            return $user;
+        });
+    }
+}
diff --git a/src/Auth/TwoFactor/Sharp2faHandler.php b/src/Auth/TwoFactor/Sharp2faHandler.php
index 3903b3c81..031be9a5e 100644
--- a/src/Auth/TwoFactor/Sharp2faHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faHandler.php
@@ -2,6 +2,8 @@
 
 namespace Code16\Sharp\Auth\TwoFactor;
 
+use Code16\Sharp\Enums\MultiFactorMethod;
+
 interface Sharp2faHandler
 {
     public function generateCode(bool $remember = false): void;
@@ -19,4 +21,6 @@ public function userId(): mixed;
     public function setUser($user): self;
 
     public function remember(): bool;
+
+    public function method(): MultiFactorMethod;
 }
diff --git a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
index 5a1d490e8..be9984703 100644
--- a/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faNotificationHandler.php
@@ -3,13 +3,15 @@
 namespace Code16\Sharp\Auth\TwoFactor;
 
 use Carbon\Carbon;
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Notifications\Notification;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Session;
 
 class Sharp2faNotificationHandler implements Sharp2faHandler
 {
-    protected $user = null;
+    protected ?Authenticatable $user = null;
 
     public function generateCode(bool $remember = false): void
     {
@@ -18,7 +20,7 @@ public function generateCode(bool $remember = false): void
         Session::put(
             $this->getSessionKey(),
             [
-                'user_id' => $this->user->id,
+                'user_id' => $this->user->getAuthIdentifier(),
                 'code' => Hash::make($code),
                 'remember' => $remember,
                 'expires_at' => now()->addMinutes(15)->format('Y-m-d H:i:s'),
@@ -81,4 +83,9 @@ protected function getSessionKey(): string
     {
         return 'sharp:2fa:code';
     }
+
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Notification;
+    }
 }
diff --git a/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
new file mode 100644
index 000000000..0f78471dd
--- /dev/null
+++ b/src/Auth/TwoFactor/Sharp2faPasskeyHandler.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace Code16\Sharp\Auth\TwoFactor;
+
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Support\Facades\Session;
+
+class Sharp2faPasskeyHandler implements Sharp2faHandler
+{
+    protected ?Authenticatable $user = null;
+
+    public function generateCode(bool $remember = false): void
+    {
+        Session::put(
+            $this->getSessionKey(),
+            [
+                'user_id' => $this->user->getAuthIdentifier(),
+                'remember' => $remember,
+            ]
+        );
+    }
+
+    public function isExpectingLogin(): bool
+    {
+        return Session::has($this->getSessionKey());
+    }
+
+    public function setUser($user): self
+    {
+        $this->user = $user;
+
+        return $this;
+    }
+
+    public function isEnabledFor($user): bool
+    {
+        return true;
+    }
+
+    public function checkCode(string $code): bool
+    {
+        throw new \Exception('Passkey multi-factor is not based on code matching');
+    }
+
+    public function userId(): mixed
+    {
+        return Session::get($this->getSessionKey())['user_id'] ?? null;
+    }
+
+    public function remember(): bool
+    {
+        return Session::get($this->getSessionKey())['remember'] ?? false;
+    }
+
+    public function forgetCode(): void
+    {
+        Session::forget($this->getSessionKey());
+    }
+
+    public function formHelpText(): string
+    {
+        return trans('sharp::auth.2fa.passkey.form_help_text', [
+            'email' => $this->user->{sharp()->config()->get('auth.login_attribute')} ?? null,
+        ]);
+    }
+
+    protected function getSessionKey(): string
+    {
+        return 'sharp:2fa:prompt-passkey';
+    }
+
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Passkey;
+    }
+}
diff --git a/src/Auth/TwoFactor/Sharp2faTotpHandler.php b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
index 762b76b41..525938b9f 100644
--- a/src/Auth/TwoFactor/Sharp2faTotpHandler.php
+++ b/src/Auth/TwoFactor/Sharp2faTotpHandler.php
@@ -3,13 +3,15 @@
 namespace Code16\Sharp\Auth\TwoFactor;
 
 use Code16\Sharp\Auth\TwoFactor\Engines\Sharp2faTotpEngine;
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Session;
 use Illuminate\Support\Str;
 
 abstract class Sharp2faTotpHandler implements Sharp2faHandler
 {
-    protected $user = null;
+    protected ?Authenticatable $user = null;
 
     public function __construct(protected Sharp2faTotpEngine $engine) {}
 
@@ -18,7 +20,7 @@ public function generateCode(bool $remember = false): void
         Session::put(
             $this->getSessionKey(),
             [
-                'user_id' => $this->user->id,
+                'user_id' => $this->user->getAuthIdentifier(),
                 'remember' => $remember,
             ]
         );
@@ -45,7 +47,7 @@ public function checkCode(string $code): bool
 
     public function userId(): mixed
     {
-        return $this->user?->id ?? (Session::get($this->getSessionKey())['user_id'] ?? null);
+        return $this->user?->getAuthIdentifier() ?? (Session::get($this->getSessionKey())['user_id'] ?? null);
     }
 
     public function remember(): bool
@@ -74,6 +76,11 @@ protected function getSessionKey(): string
         return 'sharp:2fa:code';
     }
 
+    public function method(): MultiFactorMethod
+    {
+        return MultiFactorMethod::Totp;
+    }
+
     public function setUser($user): self
     {
         $this->user = $user;
diff --git a/src/Config/SharpConfigBuilder.php b/src/Config/SharpConfigBuilder.php
index 805e8a003..915275e10 100644
--- a/src/Config/SharpConfigBuilder.php
+++ b/src/Config/SharpConfigBuilder.php
@@ -511,6 +511,18 @@ public function enable2faByTotp(): self
         return $this;
     }
 
+    public function enable2faByPasskey(): self
+    {
+        $this->config['auth']['2fa'] = [
+            'enabled' => true,
+            'handler' => 'passkey',
+        ];
+
+        $this->enablePasskeys();
+
+        return $this;
+    }
+
     public function enablePasskeys(bool $promptAfterLogin = true): self
     {
         $this->config['auth']['passkeys'] = [
diff --git a/src/Enums/MultiFactorMethod.php b/src/Enums/MultiFactorMethod.php
new file mode 100644
index 000000000..aea2955e7
--- /dev/null
+++ b/src/Enums/MultiFactorMethod.php
@@ -0,0 +1,10 @@
+<?php
+
+namespace Code16\Sharp\Enums;
+
+enum MultiFactorMethod: string
+{
+    case Notification = 'notification';
+    case Totp = 'totp';
+    case Passkey = 'passkey';
+}
diff --git a/src/Http/Controllers/Auth/Login2faController.php b/src/Http/Controllers/Auth/Login2faController.php
deleted file mode 100644
index 9495b99d4..000000000
--- a/src/Http/Controllers/Auth/Login2faController.php
+++ /dev/null
@@ -1,36 +0,0 @@
-<?php
-
-namespace Code16\Sharp\Http\Controllers\Auth;
-
-use Code16\Sharp\Auth\TwoFactor\Sharp2faHandler;
-use Code16\Sharp\Http\Controllers\Auth\Requests\Login2faRequest;
-use Illuminate\Http\RedirectResponse;
-use Illuminate\Routing\Controller;
-use Inertia\Inertia;
-use Inertia\Response;
-
-class Login2faController extends Controller
-{
-    public function create(Sharp2faHandler $sharp2faService): RedirectResponse|Response
-    {
-        if ($sharp2faService->isExpectingLogin()) {
-            $helpText = method_exists($sharp2faService, 'formHelpText')
-                ? $sharp2faService->formHelpText()
-                : trans('sharp::auth.2fa.form_help_text');
-
-            return Inertia::render('Auth/Login2Fa', [
-                'helpText' => $helpText,
-            ]);
-        }
-
-        return redirect()->route('code16.sharp.login');
-    }
-
-    public function store(Login2faRequest $request, Sharp2faHandler $sharp2faService): RedirectResponse
-    {
-        $request->authenticate($sharp2faService);
-        $request->session()->regenerate();
-
-        return redirect()->intended(route('code16.sharp.home'));
-    }
-}
diff --git a/src/Http/Controllers/Auth/LoginController.php b/src/Http/Controllers/Auth/LoginController.php
index 62390b255..6f13f92c4 100644
--- a/src/Http/Controllers/Auth/LoginController.php
+++ b/src/Http/Controllers/Auth/LoginController.php
@@ -2,6 +2,7 @@
 
 namespace Code16\Sharp\Http\Controllers\Auth;
 
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
 use Code16\Sharp\Exceptions\Auth\SharpAuthenticationNeeds2faException;
 use Code16\Sharp\Http\Controllers\Auth\Requests\LoginRequest;
 use Illuminate\Contracts\View\View;
@@ -15,15 +16,13 @@
 
 class LoginController extends Controller
 {
-    public function create(): RedirectResponse|Response
+    public function create(PasskeyManager $passkeys): RedirectResponse|Response
     {
         if ($loginPageUrl = sharp()->config()->get('auth.login_page_url')) {
             return redirect()->to($loginPageUrl);
         }
 
-        if (sharp()->config()->get('auth.passkeys.enabled')) {
-            session()->put('passkeys.redirect', route('code16.sharp.home'));
-
+        if ($passkeys->isEnabled()) {
             if (! Route::has('passkeys.login')) {
                 throw new \Exception('Passkeys routes are not defined. Add `Route::passkeys()` in your routes/web.php file.');
             }
@@ -38,11 +37,11 @@ public function create(): RedirectResponse|Response
                     ? $message->render()
                     : view('sharp::partials.login-form-message', ['message' => $message])->render()
                 : null,
-            'passkeyError' => session('authenticatePasskey::message'),
+            'passkeyError' => $passkeys->getErrorMessage(),
         ]);
     }
 
-    public function store(LoginRequest $request): RedirectResponse
+    public function store(LoginRequest $request, PasskeyManager $passkeys): RedirectResponse
     {
         try {
             $request->authenticate();
@@ -53,12 +52,11 @@ public function store(LoginRequest $request): RedirectResponse
 
         $request->session()->regenerate();
 
-        if (sharp()->config()->get('auth.passkeys.enabled')
+        if ($passkeys->isEnabled()
             && sharp()->config()->get('auth.passkeys.prompt_after_login')
             && ! $request->cookie('sharp_skip_passkey_prompt')
             && $request->boolean('supports_passkeys')
-            && method_exists($request->user(), 'passkeys')
-            && $request->user()->passkeys()->count() === 0
+            && ! $passkeys->userHasPasskey($request->user())
         ) {
             return redirect()->route('code16.sharp.passkeys.create', ['prompt' => true]);
         }
diff --git a/src/Http/Controllers/Auth/LoginMultiFactorController.php b/src/Http/Controllers/Auth/LoginMultiFactorController.php
new file mode 100644
index 000000000..683cf02a2
--- /dev/null
+++ b/src/Http/Controllers/Auth/LoginMultiFactorController.php
@@ -0,0 +1,44 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth;
+
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Code16\Sharp\Enums\MultiFactorMethod;
+use Code16\Sharp\Http\Controllers\Auth\Requests\Login2faRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class LoginMultiFactorController extends Controller
+{
+    public function create(Request $request, MultiFactorManager $multiFactor, PasskeyManager $passkeys): RedirectResponse|Response
+    {
+        $user = $multiFactor->pendingUser();
+
+        if ($user && $multiFactor->currentHandler()?->isExpectingLogin()) {
+            if ($multiFactor->currentMethod() === MultiFactorMethod::Passkey
+                && ! $passkeys->userHasPasskey($user)) {
+                return redirect()->route('code16.sharp.passkeys.create');
+            }
+
+            return Inertia::render('Auth/LoginMultiFactor', [
+                'helpText' => $multiFactor->currentHandlerHelpText(),
+                'method' => $multiFactor->currentMethod(),
+                'passkeyError' => $passkeys->getErrorMessage(),
+            ]);
+        }
+
+        return redirect()->route('code16.sharp.login');
+    }
+
+    public function store(Login2faRequest $request, MultiFactorManager $twoFactor): RedirectResponse
+    {
+        $request->authenticate($twoFactor->currentHandler());
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('code16.sharp.home'));
+    }
+}
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
new file mode 100644
index 000000000..768ffa4ff
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyAuthenticatedController.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
+
+class PasskeyAuthenticatedController extends Controller
+{
+    public function __invoke(Request $request, MultiFactorManager $multiFactor)
+    {
+        if ($multiFactor->isUsingPasskeyMethod()) {
+            $authId = Auth::guard(sharp()->config()->get('auth.guard'))->user()->getAuthIdentifier();
+            $pendingId = $multiFactor->pendingUser()?->getAuthIdentifier();
+
+            if ($authId !== $pendingId) {
+                Auth::guard(sharp()->config()->get('auth.guard'))->logout();
+
+                $request->session()->invalidate();
+                $request->session()->regenerateToken();
+
+                return redirect()->route('code16.sharp.login')
+                    ->with('status', __('sharp::auth.2fa.passkey.mismatch_error'))
+                    ->with('status_level', 'error');
+            }
+
+            $multiFactor->currentHandler()->forgetCode();
+        }
+
+        return redirect(request()->input('intended_url', route('code16.sharp.home')));
+    }
+}
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
index 3a633eea0..95749a4a2 100644
--- a/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyController.php
@@ -2,82 +2,20 @@
 
 namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
 
-use Illuminate\Contracts\Auth\Authenticatable;
-use Illuminate\Http\JsonResponse;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
-use Illuminate\Validation\ValidationException;
 use Inertia\Inertia;
 use Inertia\Response;
-use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
-use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
-use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
-use Spatie\LaravelPasskeys\Support\Config;
-use Throwable;
 
 class PasskeyController extends Controller
 {
-    public function create(Request $request): Response
+    public function create(Request $request, MultiFactorManager $multiFactor): Response
     {
         return Inertia::render('Auth/Passkeys/Create', [
             'prompt' => $request->boolean('prompt'),
+            'isMultiFactor' => $multiFactor->isUsingPasskeyMethod(),
             'cancelUrl' => redirect()->getIntendedUrl(),
         ]);
     }
-
-    public function validate(): JsonResponse
-    {
-        request()->validate([
-            'name' => 'required|string|max:255',
-        ]);
-
-        return response()->json([
-            'passkeyOptions' => json_decode($this->generatePasskeyOptions()),
-        ]);
-    }
-
-    public function store(Request $request)
-    {
-        $passkey = request()->input('passkey');
-        $storePasskeyAction = Config::getAction('store_passkey', StorePasskeyAction::class);
-
-        try {
-            $storePasskeyAction->execute(
-                $this->currentUser(),
-                $passkey, $this->previouslyGeneratedPasskeyOptions(),
-                request()->getHost(),
-                ['name' => request()->input('name')]
-            );
-        } catch (Throwable $e) {
-            throw ValidationException::withMessages([
-                'name' => __('passkeys::passkeys.error_something_went_wrong_generating_the_passkey'),
-            ])->errorBag('passkeyForm');
-        }
-
-        return redirect()->intended(route('code16.sharp.home'));
-    }
-
-    protected function currentUser(): Authenticatable&HasPasskeys
-    {
-        /** @var Authenticatable&HasPasskeys $user */
-        $user = auth()->user();
-
-        return $user;
-    }
-
-    protected function generatePasskeyOptions(): string
-    {
-        $generatePassKeyOptionsAction = Config::getAction('generate_passkey_register_options', GeneratePasskeyRegisterOptionsAction::class);
-
-        $options = $generatePassKeyOptionsAction->execute($this->currentUser());
-
-        session()->put('passkey-registration-options', $options);
-
-        return $options;
-    }
-
-    protected function previouslyGeneratedPasskeyOptions(): ?string
-    {
-        return session()->pull('passkey-registration-options');
-    }
 }
diff --git a/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php b/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php
new file mode 100644
index 000000000..9847387b3
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/PasskeyRegisteredController.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Auth;
+
+class PasskeyRegisteredController extends Controller
+{
+    public function __invoke(Request $request, MultiFactorManager $multiFactor)
+    {
+        if (! session()->has('registered_passkey')) {
+            return redirect()->route('code16.sharp.login');
+        }
+
+        if ($multiFactor->isUsingPasskeyMethod()) {
+            if ($user = $multiFactor->pendingUser()) {
+                Auth::guard(sharp()->config()->get('auth.guard'))->login($user);
+                $request->session()->regenerate();
+            }
+
+            $multiFactor->currentHandler()->forgetCode();
+        }
+
+        return redirect()->intended(route('code16.sharp.home'));
+    }
+}
diff --git a/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
new file mode 100644
index 000000000..e3b472472
--- /dev/null
+++ b/src/Http/Controllers/Auth/Passkeys/SpatiePasskeyController.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace Code16\Sharp\Http\Controllers\Auth\Passkeys;
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Illuminate\Contracts\Auth\Authenticatable;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Validation\ValidationException;
+use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
+use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
+use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
+use Spatie\LaravelPasskeys\Support\Config;
+use Throwable;
+
+class SpatiePasskeyController extends Controller
+{
+    public function validate(): JsonResponse
+    {
+        request()->validate([
+            'name' => 'required|string|max:255',
+        ]);
+
+        return response()->json([
+            'passkeyOptions' => json_decode($this->generatePasskeyOptions()),
+        ]);
+    }
+
+    public function store(Request $request)
+    {
+        $passkey = request()->input('passkey');
+        $storePasskeyAction = Config::getAction('store_passkey', StorePasskeyAction::class);
+
+        try {
+            $registeredPasskey = $storePasskeyAction->execute(
+                $this->currentUser(),
+                $passkey, $this->previouslyGeneratedPasskeyOptions(),
+                request()->getHost(),
+                ['name' => request()->input('name')]
+            );
+        } catch (Throwable $e) {
+            throw ValidationException::withMessages([
+                'name' => __('passkeys::passkeys.error_something_went_wrong_generating_the_passkey'),
+            ])->errorBag('passkeyForm');
+        }
+
+        return redirect()
+            ->route('code16.sharp.passkeys.registered')
+            ->with('registered_passkey', $registeredPasskey);
+    }
+
+    protected function currentUser(): Authenticatable&HasPasskeys
+    {
+        return app(MultiFactorManager::class)->isUsingPasskeyMethod()
+            ? app(MultiFactorManager::class)->pendingUser()
+            : auth()->user();
+    }
+
+    protected function generatePasskeyOptions(): string
+    {
+        $generatePassKeyOptionsAction = Config::getAction('generate_passkey_register_options', GeneratePasskeyRegisterOptionsAction::class);
+
+        $options = $generatePassKeyOptionsAction->execute($this->currentUser());
+
+        session()->put('passkey-registration-options', $options);
+
+        return $options;
+    }
+
+    protected function previouslyGeneratedPasskeyOptions(): ?string
+    {
+        return session()->pull('passkey-registration-options');
+    }
+}
diff --git a/src/Http/Controllers/Auth/Requests/LoginRequest.php b/src/Http/Controllers/Auth/Requests/LoginRequest.php
index 03799296c..fac39f174 100644
--- a/src/Http/Controllers/Auth/Requests/LoginRequest.php
+++ b/src/Http/Controllers/Auth/Requests/LoginRequest.php
@@ -49,7 +49,6 @@ public function authenticate(): void
 
     private function attemptToLogin(bool $remember): bool
     {
-        $guard = $this->getGuard();
         $credentials = [
             sharp()->config()->get('auth.login_attribute') => $this->input('login'),
             sharp()->config()->get('auth.password_attribute') => $this->input('password'),
@@ -57,10 +56,13 @@ private function attemptToLogin(bool $remember): bool
 
         if (sharp()->config()->get('auth.2fa.enabled')) {
             // 2fa is globally configured, but we have to ensure that the user has 2fa enabled
-            if ($guard->once($credentials)) {
+            if ($this->guard()->once($credentials)) {
                 $handler = app(Sharp2faHandler::class);
-                if ($handler->isEnabledFor($guard->user())) {
-                    $handler->setUser($guard->user())->generateCode($remember);
+                $user = $this->guard()->user();
+                Auth::forgetGuards();
+
+                if ($handler->isEnabledFor($user)) {
+                    $handler->setUser($user)->generateCode($remember);
 
                     throw new SharpAuthenticationNeeds2faException();
                 }
@@ -69,7 +71,7 @@ private function attemptToLogin(bool $remember): bool
             }
         }
 
-        return $guard->attempt($credentials, $remember);
+        return $this->guard()->attempt($credentials, $remember);
     }
 
     private function ensureIsNotRateLimited(): void
@@ -102,7 +104,7 @@ private function throttleKey(): string
         return Str::transliterate(Str::lower($this->input('login')).'|'.$this->ip());
     }
 
-    private function getGuard(): StatefulGuard
+    private function guard(): StatefulGuard
     {
         return Auth::guard(sharp()->config()->get('auth.guard'));
     }
diff --git a/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php b/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php
new file mode 100644
index 000000000..85753fbab
--- /dev/null
+++ b/src/Http/Middleware/SharpAuthenticateOrInMultiFactor.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace Code16\Sharp\Http\Middleware;
+
+use Closure;
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+
+class SharpAuthenticateOrInMultiFactor extends SharpAuthenticate
+{
+    public function handle($request, Closure $next, ...$guards)
+    {
+        $multiFactor = app(MultiFactorManager::class);
+
+        if ($multiFactor->isEnabled() && $multiFactor->currentHandler()?->isExpectingLogin()) {
+            return $next($request);
+        }
+
+        return parent::handle($request, $next, ...$guards);
+    }
+}
diff --git a/src/SharpInternalServiceProvider.php b/src/SharpInternalServiceProvider.php
index de7d76a15..d116b504a 100644
--- a/src/SharpInternalServiceProvider.php
+++ b/src/SharpInternalServiceProvider.php
@@ -3,13 +3,15 @@
 namespace Code16\Sharp;
 
 use Code16\Sharp\Auth\Impersonate\SharpImpersonationHandler;
-use Code16\Sharp\Auth\Passkeys\PasskeyEventSubscriber;
+use Code16\Sharp\Auth\Passkeys\PasskeyManager;
+use Code16\Sharp\Auth\Passkeys\SpatiePasskeyManager;
 use Code16\Sharp\Auth\SharpAuthorizationManager;
 use Code16\Sharp\Auth\TwoFactor\Engines\GoogleTotpEngine;
 use Code16\Sharp\Auth\TwoFactor\Engines\Sharp2faTotpEngine;
 use Code16\Sharp\Auth\TwoFactor\Sharp2faEloquentDefaultTotpHandler;
 use Code16\Sharp\Auth\TwoFactor\Sharp2faHandler;
 use Code16\Sharp\Auth\TwoFactor\Sharp2faNotificationHandler;
+use Code16\Sharp\Auth\TwoFactor\Sharp2faPasskeyHandler;
 use Code16\Sharp\Config\SharpConfigBuilder;
 use Code16\Sharp\Console\DashboardMakeCommand;
 use Code16\Sharp\Console\EntityCommandMakeCommand;
@@ -89,7 +91,7 @@ public function boot()
 
         $this->configureOctane();
 
-        Event::subscribe(PasskeyEventSubscriber::class);
+        Event::subscribe(PasskeyManager::class);
     }
 
     public function register()
@@ -114,6 +116,7 @@ public function register()
             fn () => match (sharp()->config()->get('auth.2fa.handler')) {
                 'notification' => app(Sharp2faNotificationHandler::class),
                 'totp' => app(Sharp2faEloquentDefaultTotpHandler::class),
+                'passkey' => app(Sharp2faPasskeyHandler::class),
                 default => sharp()->config()->get('auth.2fa.handler'),
             }
         );
@@ -124,6 +127,8 @@ public function register()
                 : null;
         });
 
+        $this->app->bind(PasskeyManager::class, SpatiePasskeyManager::class);
+
         $this->app->register(InertiaServiceProvider::class);
 
         $this->app->rebinding('request', function ($app, $request) {
diff --git a/src/routes/auth/login.php b/src/routes/auth/login.php
index eef994290..a70dc4009 100644
--- a/src/routes/auth/login.php
+++ b/src/routes/auth/login.php
@@ -1,7 +1,7 @@
 <?php
 
-use Code16\Sharp\Http\Controllers\Auth\Login2faController;
 use Code16\Sharp\Http\Controllers\Auth\LoginController;
+use Code16\Sharp\Http\Controllers\Auth\LoginMultiFactorController;
 use Illuminate\Support\Facades\Route;
 
 Route::middleware(['sharp_common', 'sharp_web'])
@@ -15,10 +15,12 @@
             ->middleware('sharp_guest')
             ->name('code16.sharp.login.post');
 
-        Route::get('/login/2fa', [Login2faController::class, 'create'])
+        Route::get('/login/2fa', [LoginMultiFactorController::class, 'create'])
+            ->middleware('sharp_guest')
             ->name('code16.sharp.login.2fa');
 
-        Route::post('/login/2fa', [Login2faController::class, 'store'])
+        Route::post('/login/2fa', [LoginMultiFactorController::class, 'store'])
+            ->middleware('sharp_guest')
             ->name('code16.sharp.login.2fa.post');
 
         Route::post('/logout', [LoginController::class, 'destroy'])
diff --git a/src/routes/auth/passkeys.php b/src/routes/auth/passkeys.php
index 41ded79c8..3f982c7ee 100644
--- a/src/routes/auth/passkeys.php
+++ b/src/routes/auth/passkeys.php
@@ -1,21 +1,35 @@
 <?php
 
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyAuthenticatedController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyController;
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeyRegisteredController;
 use Code16\Sharp\Http\Controllers\Auth\Passkeys\PasskeySkipPromptController;
+use Code16\Sharp\Http\Controllers\Auth\Passkeys\SpatiePasskeyController;
+use Code16\Sharp\Http\Middleware\SharpAuthenticateOrInMultiFactor;
 use Illuminate\Support\Facades\Route;
 
-Route::middleware(['sharp_common', 'sharp_web', 'sharp_auth'])
+Route::middleware(['sharp_common', 'sharp_web'])
     ->prefix('/'.sharp()->config()->get('custom_url_segment'))
     ->group(function () {
-        Route::get('/passkeys/create', [PasskeyController::class, 'create'])
-            ->name('code16.sharp.passkeys.create');
+        Route::middleware([SharpAuthenticateOrInMultiFactor::class])->group(function () {
+            Route::get('/passkeys/create', [PasskeyController::class, 'create'])
+                ->name('code16.sharp.passkeys.create');
 
-        Route::post('/passkeys/validate', [PasskeyController::class, 'validate'])
-            ->name('code16.sharp.passkeys.validate');
+            Route::post('/spatie-passkeys/validate', [SpatiePasskeyController::class, 'validate'])
+                ->name('code16.sharp.passkeys.spatie.validate');
 
-        Route::post('/passkeys', [PasskeyController::class, 'store'])
-            ->name('code16.sharp.passkeys.store');
+            Route::post('/spatie-passkeys', [SpatiePasskeyController::class, 'store'])
+                ->name('code16.sharp.passkeys.spatie.store');
+        });
 
-        Route::post('/passkeys/skip-prompt', PasskeySkipPromptController::class)
-            ->name('code16.sharp.passkeys.skip-prompt');
+        Route::get('/passkeys/registered', PasskeyRegisteredController::class)
+            ->name('code16.sharp.passkeys.registered');
+
+        Route::middleware(['sharp_auth'])->group(function () {
+            Route::post('/passkeys/skip-prompt', PasskeySkipPromptController::class)
+                ->name('code16.sharp.passkeys.skip-prompt');
+
+            Route::get('/passkeys/authenticated', PasskeyAuthenticatedController::class)
+                ->name('code16.sharp.passkeys.authenticated');
+        });
     });
diff --git a/tests/Fixtures/TestAuthGuard.php b/tests/Fixtures/TestAuthGuard.php
index 0634d5b63..dc82881c5 100644
--- a/tests/Fixtures/TestAuthGuard.php
+++ b/tests/Fixtures/TestAuthGuard.php
@@ -8,7 +8,8 @@
 
 class TestAuthGuard implements Guard, StatefulGuard
 {
-    private ?User $user = null;
+    private ?Authenticatable $user = null;
+    public bool $isOnce = false;
 
     public function check()
     {
@@ -27,7 +28,7 @@ public function user()
 
     public function id()
     {
-        return $this->hasUser() ? 1 : null;
+        return $this->user?->id;
     }
 
     public function validate(array $credentials = []) {}
@@ -45,7 +46,7 @@ public function hasUser()
     public function attempt(array $credentials = [], $remember = false)
     {
         if ($credentials['email'] === 'test@example.org' && $credentials['password'] === 'password') {
-            $this->login(new User(array_merge($credentials, ['shouldRemember' => $remember])));
+            $this->login(new User(['id' => 1, ...$credentials, 'shouldRemember' => $remember]));
 
             return true;
         }
@@ -56,7 +57,8 @@ public function attempt(array $credentials = [], $remember = false)
     public function once(array $credentials = [])
     {
         if ($credentials['email'] === 'test@example.org' && $credentials['password'] === 'password') {
-            $this->setUser(new User($credentials));
+            $this->setUser(new User(['id' => 1, ...$credentials]));
+            $this->isOnce = true;
 
             return true;
         }
@@ -69,9 +71,21 @@ public function login(Authenticatable $user, $remember = false)
         $this->setUser($user);
     }
 
-    public function loginUsingId($id, $remember = false) {}
+    public function loginUsingId($id, $remember = false)
+    {
+        if ($id === 1) {
+            $this->login($user = new User(['id' => 1, 'email' => 'test@example.org']));
+
+            return $user;
+        }
+
+        return false;
+    }
 
-    public function onceUsingId($id) {}
+    public function onceUsingId($id)
+    {
+        return $this->loginUsingId($id);
+    }
 
     public function viaRemember() {}
 
diff --git a/tests/Http/Auth/Login2faNotificationTest.php b/tests/Http/Auth/MultiFactorNotificationTest.php
similarity index 88%
rename from tests/Http/Auth/Login2faNotificationTest.php
rename to tests/Http/Auth/MultiFactorNotificationTest.php
index bf01f6424..31a4ce0a8 100644
--- a/tests/Http/Auth/Login2faNotificationTest.php
+++ b/tests/Http/Auth/MultiFactorNotificationTest.php
@@ -4,7 +4,6 @@
 use Code16\Sharp\Auth\TwoFactor\Sharp2faNotificationHandler;
 use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
 use Code16\Sharp\Tests\Fixtures\TestAuthGuard;
-use Code16\Sharp\Tests\Fixtures\User;
 use Illuminate\Support\Facades\Notification;
 
 beforeEach(function () {
@@ -20,7 +19,11 @@
 it('redirects to 2fa code page after successful first step login', function () {
     Notification::fake();
 
-    $this->post(route('code16.sharp.login.post'), ['login' => 'test@example.org', 'password' => 'password'])
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
         ->assertRedirect(route('code16.sharp.login.2fa'));
 });
 
@@ -35,15 +38,14 @@
 it('sends to the user a 2fa notification after successful first step login', function () {
     Notification::fake();
 
-    $this->post(
-        route('code16.sharp.login.post'),
-        ['login' => 'test@example.org', 'password' => 'password']
-    );
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
 
-    Notification::assertSentTo(
-        new User(['email' => 'test@example.org']),
-        Sharp2faDefaultNotification::class
-    );
+    Notification::assertSentTimes(Sharp2faDefaultNotification::class, 1);
 });
 
 it('logs in the user after successful 2fa code validation', function () {
diff --git a/tests/Http/Auth/Login2faTotpTest.php b/tests/Http/Auth/MultiFactorTotpTest.php
similarity index 97%
rename from tests/Http/Auth/Login2faTotpTest.php
rename to tests/Http/Auth/MultiFactorTotpTest.php
index b84573e00..066aea961 100644
--- a/tests/Http/Auth/Login2faTotpTest.php
+++ b/tests/Http/Auth/MultiFactorTotpTest.php
@@ -73,7 +73,11 @@ protected function checkUserRecoveryCode(mixed $userId, string $code): bool
 });
 
 it('redirects to 2fa code page after successful first step login', function () {
-    $this->post(route('code16.sharp.login.post'), ['login' => 'test@example.org', 'password' => 'password'])
+    $this
+        ->post(
+            route('code16.sharp.login.post'),
+            ['login' => 'test@example.org', 'password' => 'password']
+        )
         ->assertRedirect(route('code16.sharp.login.2fa'));
 });
 
diff --git a/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php
new file mode 100644
index 000000000..951ad9f5c
--- /dev/null
+++ b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysMultiFactorTest.php
@@ -0,0 +1,137 @@
+<?php
+
+use Code16\Sharp\Auth\TwoFactor\MultiFactorManager;
+use Code16\Sharp\Tests\Fixtures\Entities\PersonEntity;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Facades\Schema;
+use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
+use Spatie\LaravelPasskeys\Models\Passkey;
+
+use function Orchestra\Testbench\Pest\defineEnvironment;
+use function Orchestra\Testbench\Pest\defineRoutes;
+
+require_once __DIR__.'/helpers.php';
+
+pest()->use(LazilyRefreshDatabase::class);
+
+defineEnvironment(function () {
+    sharp()->config()
+        ->enable2faByPasskey()
+        ->declareEntity(PersonEntity::class);
+});
+
+defineRoutes(function () {
+    Route::passkeys();
+});
+
+beforeEach(function () {
+    Schema::create('users', function (Blueprint $table) {
+        $table->increments('id');
+        $table->string('name')->nullable();
+        $table->string('email');
+        $table->string('password')->nullable();
+        $table->string('remember_token')->nullable();
+        $table->timestamps();
+    });
+
+    Schema::create('passkeys', function (Blueprint $table) {
+        $table->id();
+        $table->unsignedInteger('authenticatable_id');
+        $table->text('name');
+        $table->text('credential_id');
+        $table->json('data');
+        $table->timestamp('last_used_at')->nullable();
+        $table->timestamps();
+    });
+
+    config()->set('auth.providers.users.model', PasskeyTestUser::class);
+    config()->set('passkeys.models.authenticatable', PasskeyTestUser::class);
+    config()->set('passkeys.models.passkey', TestPasskey::class);
+});
+
+it('authenticates user directly when logging in with passkey', function () {
+    $user = createPasskeyUser();
+    $passkey = createPasskey($user);
+
+    loginUsingSpatiePasskey($passkey);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+});
+
+it('redirects to 2fa page when user has a passkey', function () {
+    $user = createPasskeyUser();
+    $passkey = createPasskey($user);
+
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $user->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertOk();
+
+    loginUsingSpatiePasskey($passkey);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+});
+
+it('redirects to login with mismatch message when using another user passkey (test 4)', function () {
+    $userA = createPasskeyUser(['email' => 'userA@example.org']);
+    $userB = createPasskeyUser(['email' => 'userB@example.org']);
+    createPasskey($userA);
+    $passkeyB = createPasskey($userB);
+
+    // User A starts login
+    $this->post(route('code16.sharp.login.post'), [
+        'login' => $userA->email,
+        'password' => 'password',
+    ])->assertRedirect(route('code16.sharp.login.2fa'));
+
+    loginUsingSpatiePasskey($passkeyB);
+
+    test()->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.login'))
+        ->assertSessionHas('status', __('sharp::auth.2fa.passkey.mismatch_error'));
+});
+
+it('redirects to passkey creation when user has no passkey', function () {
+    $user = createPasskeyUser();
+
+    $this->post(
+        route('code16.sharp.login.post'),
+        ['login' => $user->email, 'password' => 'password']
+    )
+        ->assertRedirect(route('code16.sharp.login.2fa'));
+
+    $this->get(route('code16.sharp.login.2fa'))
+        ->assertRedirect(route('code16.sharp.passkeys.create'));
+
+    expect(app(MultiFactorManager::class)->pendingUser()->id)->toBe($user->id);
+
+    config()->set('passkeys.actions.store_passkey', FakeStorePasskeyActionForMultiFactor::class);
+
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'))
+        ->assertRedirect(route('code16.sharp.passkeys.registered'));
+
+    $this->get(route('code16.sharp.passkeys.registered'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->id())->toBe($user->id);
+    expect(app(MultiFactorManager::class)->pendingUser())->toBeNull();
+});
+
+class FakeStorePasskeyActionForMultiFactor extends StorePasskeyAction
+{
+    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
+    {
+        return new TestPasskey();
+    }
+}
diff --git a/tests/Http/Auth/PasskeysTest.php b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
similarity index 71%
rename from tests/Http/Auth/PasskeysTest.php
rename to tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
index b7151733d..19d5144f0 100644
--- a/tests/Http/Auth/PasskeysTest.php
+++ b/tests/Http/Auth/SpatiePasskeys/SpatiePasskeysTest.php
@@ -1,6 +1,5 @@
 <?php
 
-namespace Code16\Sharp\Tests\Http\Auth;
 
 use Code16\Sharp\Auth\Passkeys\Commands\UpdatePasskeyNameCommand;
 use Code16\Sharp\Auth\Passkeys\Entity\PasskeyEntity;
@@ -14,8 +13,10 @@
 use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
 use Illuminate\Support\Facades\Cookie;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Schema;
 use Illuminate\Validation\ValidationException;
+use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
 use Spatie\LaravelPasskeys\Actions\GeneratePasskeyRegisterOptionsAction;
 use Spatie\LaravelPasskeys\Actions\StorePasskeyAction;
 use Spatie\LaravelPasskeys\Events\PasskeyUsedToAuthenticateEvent;
@@ -26,6 +27,10 @@
 use Webauthn\PublicKeyCredentialCreationOptions;
 
 use function Orchestra\Testbench\Pest\defineEnvironment;
+use function Orchestra\Testbench\Pest\defineRoutes;
+
+
+require_once __DIR__.'/helpers.php';
 
 pest()->use(LazilyRefreshDatabase::class);
 
@@ -33,6 +38,10 @@
     sharp()->config()->enablePasskeys();
 });
 
+defineRoutes(function () {
+    Route::passkeys();
+});
+
 beforeEach(function () {
     Schema::create('users', function (Blueprint $table) {
         $table->increments('id');
@@ -61,43 +70,6 @@
         ->declareEntity(PersonEntity::class);
 });
 
-function createPasskeyTestUser(array $attributes = []): PasskeyTestUser
-{
-    return PasskeyTestUser::create(array_merge([
-        'email' => 'test@example.org',
-        'name' => 'Test',
-    ], $attributes));
-}
-
-function createPasskey(PasskeyTestUser $user, array $attributes = []): TestPasskey
-{
-    $attrs = array_merge([
-        'name' => 'My Passkey',
-        'credential_id' => 'test-credential-'.uniqid(),
-        'last_used_at' => null,
-    ], $attributes);
-
-    $id = DB::table('passkeys')->insertGetId([
-        'authenticatable_id' => $user->id,
-        'name' => $attrs['name'],
-        'credential_id' => $attrs['credential_id'],
-        'data' => json_encode(['test' => true]),
-        'last_used_at' => $attrs['last_used_at'],
-        'created_at' => $attrs['created_at'] ?? now(),
-        'updated_at' => now(),
-    ]);
-
-    return TestPasskey::find($id);
-}
-
-function loginPasskeyUser(?PasskeyTestUser $user = null)
-{
-    test()->actingAs(
-        $user ?: createPasskeyTestUser(),
-        sharp()->config()->get('auth.guard') ?: 'web'
-    );
-}
-
 // --- PasskeyEntity tests ---
 
 it('has correct prohibited actions', function () {
@@ -110,9 +82,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyList data ---
 
 it('returns list data for authenticated user', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user, ['name' => 'My Passkey', 'last_used_at' => now()->subDay()]);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -122,10 +94,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('does not return passkeys of other users', function () {
-    $user = createPasskeyTestUser();
-    $otherUser = createPasskeyTestUser(['email' => 'other@example.org']);
+    $user = createPasskeyUser();
+    $otherUser = createPasskeyUser(['email' => 'other@example.org']);
     createPasskey($otherUser, ['name' => 'Other Passkey']);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -134,9 +106,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('transforms last_used_at to human readable format', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user, ['last_used_at' => now()->subHour()]);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $data = $list->getListData();
@@ -147,9 +119,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyList delete ---
 
 it('deletes a passkey for the authenticated user', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
     $list->delete($passkey->id);
@@ -158,10 +130,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('cannot delete another user passkey', function () {
-    $user = createPasskeyTestUser();
-    $otherUser = createPasskeyTestUser(['email' => 'other@example.org']);
+    $user = createPasskeyUser();
+    $otherUser = createPasskeyUser(['email' => 'other@example.org']);
     $passkey = createPasskey($otherUser);
-    loginPasskeyUser($user);
+    login($user);
 
     $list = app(PasskeyList::class);
 
@@ -172,9 +144,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- UpdatePasskeyNameCommand ---
 
 it('renames a passkey', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $command = app(UpdatePasskeyNameCommand::class);
     $command->execute($passkey->id, ['name' => 'Renamed Passkey']);
@@ -183,9 +155,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('validates name is required when renaming', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     $command = app(UpdatePasskeyNameCommand::class);
 
@@ -193,16 +165,27 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
         ->toThrow(ValidationException::class);
 });
 
+it('authenticates user directly when logging in with passkey', function () {
+    $user = createPasskeyUser();
+    $passkey = createPasskey($user);
+
+    loginUsingSpatiePasskey($passkey);
+
+    $this->get(route('code16.sharp.passkeys.authenticated'))
+        ->assertRedirect(route('code16.sharp.home'));
+
+    expect(auth()->check())->toBeTrue();
+    expect(auth()->user()->id)->toBe($user->id);
+});
+
 // --- PasskeyEventSubscriber ---
 
 it('queues a cookie when passkey is used to authenticate', function () {
     // here we expects the SharpInternalServiceProvider is booted
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
 
-    $request = \Mockery::mock(AuthenticateUsingPasskeysRequest::class);
-    $event = new PasskeyUsedToAuthenticateEvent($passkey, $request);
-    app(Dispatcher::class)->dispatch($event);
+    loginUsingSpatiePasskey($passkey);
 
     $queued = Cookie::getQueuedCookies();
     $names = array_map(fn ($c) => $c->getName(), $queued);
@@ -212,9 +195,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- Usage badge ---
 
 it('shows usage badge when passkey matches cookie', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     $passkey = createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     request()->cookies->set('sharp_last_used_passkey', (string) $passkey->id);
 
@@ -225,9 +208,9 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('does not show usage badge when passkey does not match cookie', function () {
-    $user = createPasskeyTestUser();
+    $user = createPasskeyUser();
     createPasskey($user);
-    loginPasskeyUser($user);
+    login($user);
 
     request()->cookies->set('sharp_last_used_passkey', '99999');
 
@@ -240,14 +223,14 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 // --- PasskeyController tests ---
 
 it('renders the passkey create page', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->get(route('code16.sharp.passkeys.create'))
         ->assertOk();
 });
 
 it('renders the passkey create page with prompt parameter', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->get(route('code16.sharp.passkeys.create', ['prompt' => 1]))
         ->assertOk();
@@ -259,40 +242,40 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
 });
 
 it('validates name on passkey validate endpoint', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => ''])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => ''])
         ->assertJsonValidationErrors('name');
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => str_repeat('a', 256)])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => str_repeat('a', 256)])
         ->assertJsonValidationErrors('name');
 });
 
 it('returns passkey options on successful validate', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     // Configure a fake action that returns a JSON string
     config()->set('passkeys.actions.generate_passkey_register_options', FakeGeneratePasskeyRegisterOptionsAction::class);
 
-    $this->postJson(route('code16.sharp.passkeys.validate'), ['name' => 'My Key'])
+    $this->postJson(route('code16.sharp.passkeys.spatie.validate'), ['name' => 'My Key'])
         ->assertOk()
         ->assertJsonStructure(['passkeyOptions']);
 });
 
 it('store endpoint requires authentication', function () {
-    $this->post(route('code16.sharp.passkeys.store'))
+    $this->post(route('code16.sharp.passkeys.spatie.store'))
         ->assertRedirect();
 });
 
 it('store endpoint catches action errors and throws validation exception', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     // Put fake options in session as the controller expects them
     session()->put('passkey-registration-options', '{"fake":"options"}');
 
-    $this->postJson(route('code16.sharp.passkeys.store'), [
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'), [
         'passkey' => 'invalid-passkey-data',
         'name' => 'My Key',
     ])
@@ -300,18 +283,10 @@ function loginPasskeyUser(?PasskeyTestUser $user = null)
         ->assertJsonValidationErrors('name');
 });
 
-class FakeStorePasskeyAction extends StorePasskeyAction
-{
-    public static $mock;
-    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
-    {
-        return static::$mock->execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties);
-    }
-}
 
 it('store endpoint calls StorePasskeyAction with appropriate arguments', function () {
-    $user = createPasskeyTestUser();
-    loginPasskeyUser($user);
+    $user = createPasskeyUser();
+    login($user);
 
     $passkeyData = '{"id":"some-id","rawId":"some-raw-id","type":"public-key","response":{"attestationObject":"some-attestation","clientDataJSON":"some-client-data"}}';
     $passkeyOptions = '{"challenge":"some-challenge"}';
@@ -319,7 +294,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 
     session()->put('passkey-registration-options', $passkeyOptions);
 
-    $mockAction = \Mockery::mock(Spatie\LaravelPasskeys\Actions\StorePasskeyAction::class);
+    $mockAction = \Mockery::mock(StorePasskeyAction::class);
     $mockAction->shouldReceive('execute')
         ->once()
         ->withArgs(function ($authenticatable, $passkeyJson, $optionsJson, $host, $additionalProperties) use ($user, $passkeyData, $passkeyOptions, $passkeyName) {
@@ -334,11 +309,11 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
     FakeStorePasskeyAction::$mock = $mockAction;
     config()->set('passkeys.actions.store_passkey', FakeStorePasskeyAction::class);
 
-    $this->postJson(route('code16.sharp.passkeys.store'), [
+    $this->postJson(route('code16.sharp.passkeys.spatie.store'), [
         'passkey' => $passkeyData,
         'name' => $passkeyName,
     ])
-        ->assertRedirect(route('code16.sharp.home'));
+        ->assertRedirect(route('code16.sharp.passkeys.registered'));
 
     $mockAction->shouldHaveReceived('execute');
 });
@@ -346,7 +321,7 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 // --- PasskeySkipPromptController tests ---
 
 it('skip prompt redirects to home with cookie', function () {
-    loginPasskeyUser();
+    login(createPasskeyUser());
 
     $this->post(route('code16.sharp.passkeys.skip-prompt'))
         ->assertRedirect(route('code16.sharp.home'))
@@ -355,16 +330,12 @@ public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $ho
 
 // --- Fixtures ---
 
-class TestPasskey extends Passkey
+class FakeStorePasskeyAction extends StorePasskeyAction
 {
-    protected $table = 'passkeys';
-
-    public function data(): Attribute
+    public static $mock;
+    public function execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties = []): Passkey
     {
-        return new Attribute(
-            get: fn ($value) => $value,
-            set: fn ($value) => ['data' => is_string($value) ? $value : json_encode($value)],
-        );
+        return static::$mock->execute($authenticatable, $passkeyJson, $passkeyOptionsJson, $hostName, $additionalProperties);
     }
 }
 
@@ -376,24 +347,3 @@ public function execute(HasPasskeys $authenticatable, bool $asJson = true): stri
     }
 }
 
-class PasskeyTestUser extends User implements HasPasskeys
-{
-    use InteractsWithPasskeys;
-
-    protected $table = 'users';
-
-    public function getPasskeyName(): string
-    {
-        return $this->email;
-    }
-
-    public function getPasskeyId(): string
-    {
-        return (string) $this->id;
-    }
-
-    public function getPasskeyDisplayName(): string
-    {
-        return $this->name ?? $this->email;
-    }
-}
diff --git a/tests/Http/Auth/SpatiePasskeys/helpers.php b/tests/Http/Auth/SpatiePasskeys/helpers.php
new file mode 100644
index 000000000..4e81a820c
--- /dev/null
+++ b/tests/Http/Auth/SpatiePasskeys/helpers.php
@@ -0,0 +1,95 @@
+<?php
+
+use Code16\Sharp\Tests\Fixtures\User;
+use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Spatie\LaravelPasskeys\Actions\FindPasskeyToAuthenticateAction;
+use Spatie\LaravelPasskeys\Models\Concerns\HasPasskeys;
+use Spatie\LaravelPasskeys\Models\Concerns\InteractsWithPasskeys;
+use Spatie\LaravelPasskeys\Models\Passkey;
+
+function loginUsingSpatiePasskey(Passkey $passkey): void
+{
+    FakeFindPasskeyToAuthenticateAction::$passkey = $passkey;
+
+    config()->set('passkeys.actions.find_passkey', FakeFindPasskeyToAuthenticateAction::class);
+    session()->put('passkey-authentication-options', 'test');
+
+    test()->post(route('passkeys.login'), ['start_authentication_response' => '{}'], headers: ['X-Sharp' => '1'])
+        ->assertSessionMissing('authenticatePasskey::message')
+        ->assertSessionHasNoErrors()
+        ->assertRedirect(route('code16.sharp.passkeys.authenticated', [
+            'intended_url' => route('code16.sharp.home'),
+        ]));
+}
+
+function createPasskey(PasskeyTestUser $user, array $attributes = []): TestPasskey
+{
+    $id = DB::table('passkeys')->insertGetId([
+        'authenticatable_id' => $user->id,
+        'name' => 'My Passkey',
+        'credential_id' => 'test-credential-'.uniqid(),
+        'data' => json_encode(['test' => true]),
+        'last_used_at' => null,
+        'created_at' => now(),
+        'updated_at' => now(),
+        ...$attributes,
+    ]);
+
+    return TestPasskey::find($id);
+}
+
+function createPasskeyUser(array $attributes = []): PasskeyTestUser
+{
+    return PasskeyTestUser::create(array_merge([
+        'email' => 'test@example.org',
+        'name' => 'Test',
+        'password' => Hash::make('password'),
+    ], $attributes));
+}
+
+class FakeFindPasskeyToAuthenticateAction extends FindPasskeyToAuthenticateAction
+{
+    public static ?Passkey $passkey = null;
+
+    public function execute(string $publicKeyCredentialJson, string $passkeyOptionsJson): ?Passkey
+    {
+        return self::$passkey;
+    }
+}
+
+class PasskeyTestUser extends User implements HasPasskeys
+{
+    use InteractsWithPasskeys;
+
+    protected $table = 'users';
+
+    public function getPasskeyName(): string
+    {
+        return $this->email;
+    }
+
+    public function getPasskeyId(): string
+    {
+        return (string) $this->id;
+    }
+
+    public function getPasskeyDisplayName(): string
+    {
+        return $this->name ?? $this->email;
+    }
+}
+
+class TestPasskey extends Passkey
+{
+    protected $table = 'passkeys';
+
+    public function data(): Attribute
+    {
+        return new Attribute(
+            get: fn ($value) => $value,
+            set: fn ($value) => ['data' => is_string($value) ? $value : json_encode($value)],
+        );
+    }
+}
diff --git a/tests/Pest.php b/tests/Pest.php
index 1b0b67082..21b4ee5ee 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -1,5 +1,6 @@
 <?php
 
+use Code16\Sharp\Filters\GlobalFilters\GlobalFilters;
 use Code16\Sharp\Filters\GlobalRequiredFilter;
 use Code16\Sharp\Tests\Fixtures\User;
 use Code16\Sharp\Tests\TestCase;
@@ -7,6 +8,7 @@
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Facades\URL;
 
 uses(TestCase::class)
     ->in(__DIR__);
@@ -15,7 +17,7 @@
     ->beforeEach(function () {
         // We add a default here to avoid putting this everywhere in unit tests
         // it's handled by middleware in a real request, but we don't want to test that here.
-        \Illuminate\Support\Facades\URL::defaults(['globalFilter' => \Code16\Sharp\Filters\GlobalFilters\GlobalFilters::$defaultKey]);
+        URL::defaults(['globalFilter' => GlobalFilters::$defaultKey]);
     })
     ->in(__DIR__);
 
diff --git a/tests/TestCase.php b/tests/TestCase.php
index e14c026a7..85f59cdfd 100644
--- a/tests/TestCase.php
+++ b/tests/TestCase.php
@@ -9,6 +9,7 @@
 use Orchestra\Testbench\Pest\WithPest;
 use Orchestra\Testbench\TestCase as Orchestra;
 use Spatie\LaravelImageOptimizer\ImageOptimizerServiceProvider;
+use Spatie\LaravelPasskeys\LaravelPasskeysServiceProvider;
 
 class TestCase extends Orchestra
 {
@@ -28,6 +29,7 @@ protected function getPackageProviders($app): array
             ContentRendererServiceProvider::class,
             BladeIconsServiceProvider::class,
             ImageOptimizerServiceProvider::class,
+            LaravelPasskeysServiceProvider::class,
         ];
     }