Question Social Login Deprecation – What About Passkey Support?

[TorbHo]

Server operating system version

Ubuntu 26.04

Plesk version and microupdate number

18.0.82 Update #3

Hi Plesk Team,

I noticed that the Social Login extension has been marked as deprecated.

I'm curious why the extension is being discontinued, especially since it also provides Passkey support for Plesk.

Personally, Passkeys are the only reason I use this extension, and I consider them a very important security feature. Passwordless authentication using Passkeys is becoming increasingly important, so losing this functionality would be a significant step backward.

Are there any plans to provide native Passkey support in Plesk or introduce an alternative before the extension is removed?

I'd really appreciate some clarification on the reasons behind this decision and the future of Passkey authentication in Plesk.

Thanks!

 

[Sebahat.hadzhi]

Thank you for raising the question, @TorbHo . Our team decided to deprecate the extension mainly because of steady usage decline over the course of the past several years and ongoing maintenance requirements related to the third-party authentication providers.

Regarding Passkeys, unfortunately, there is currently no direct replacement. The closest alternatives suggested are sign-in through a WebPros Account and user/password + MFA authentication.

Passkeys in MFA are evaluated as a separate 2027 roadmap item. However, I cannot currently guarantee its implementation or availability.

 

[TorbHo]

@Sebahat.hadzhi

Thank you for the clarification.

However, I find this decision very disappointing. You simply cannot remove an important security feature like Passkey authentication on such short notice without providing a proper alternative first.

Passkeys are not exactly a new technology anymore. They have been around for years and, in my opinion, should already be the standard for authentication everywhere, especially in security-sensitive products like Plesk.

I've personally implemented Passkey authentication in several projects, so I honestly struggle to understand why introducing native Passkey support would take so long. From my experience, implementing Passkeys is relatively straightforward, especially with the libraries and standards available today.

The fact that Passkeys are only being evaluated for the 2027 roadmap, without any guarantee of implementation, is quite concerning.

I strongly believe the existing Passkey functionality should remain available until a proper native replacement is implemented. Removing it first and potentially bringing it back years later simply doesn't make sense from a security perspective.

 

[tessa67]

Hi @Sebahat.hadzhi, and thanks for the quick reply!

I’m with @TorbHo 100% on this one. Dropping Social Login without a real replacement feels like a step backwards, and I’d really like to ask the Plesk team to reconsider.

“Declining usage” isn’t a good reason to remove a security feature.
Low usage tells you a feature is niche, not that it’s unimportant. Security features are exactly the ones you want to have before you need them. And usage looks different once you separate “Social Login for Google/Facebook” from “the only way to get Passkeys into Plesk”. Many admins (like TorbHo) use the extension purely for the latter. A usage graph can’t tell those two groups apart.

The maintenance burden is real, but it doesn’t apply to the part people care about.
The cost comes from third-party providers changing their APIs. Passkeys (WebAuthn) are an open standard, with no provider dependency and no API churn. If maintenance is the issue, keep or ship a slim, Passkey-only variant and drop the provider zoo.

“Use a WebPros Account or password + MFA” is not a replacement.
It pushes people back to passwords, which is the weak point we’re all trying to get away from. Nobody can remember dozens of unique, strong passwords anymore. Passkeys let you sign in with your phone or a hardware key, which is great for people who (for good reasons) don’t want to store passwords in their browser. Phishing resistance is the big win here, and a Plesk panel with root-level access is a prime phishing target.

“Evaluating for 2027 without guarantee” leaves a gap of a year or more.
Removing the feature first and maybe bringing it back later makes no sense from a security standpoint. The sane order is: ship the replacement, then retire the old thing. That’s standard deprecation practice almost everywhere else.

Timing feels odd.
With prices going up, I’d expect security features to get more investment, not less. Cutting a relevant security feature while customers are paying more is a hard sell.

My ask:

1. Please keep Social Login (or at least its Passkey function) alive until native Passkey support exists.
2. If the decision is final, please provide a proper alternative before removal, ideally native Passkeys for panel login and not only as an MFA item.
3. If that’s really not possible, at least offer a certificate-based option (client certificates / mTLS) so security-conscious admins have a passwordless path.

Passkey support doesn’t have to be perfect on day one. A basic, solid implementation would already help a lot of us. Could you share a rough timeline, or whether a smaller interim solution is possible? Thanks for listening!

Regards
Tessa