Passkey progressive enrollment: does it work for OTP/magic-link-only users?

[pablospe]

Summary

After enabling Passkeys and Progressive Enrollment in the WorkOS Dashboard (staging environment), the "Create a passkey" prompt never appears during sign-in.

The user authenticates via OTP / magic link only (no password set). The docs mention progressive enrollment prompts "users who are still using password-based authentication" — does this mean OTP-only users are excluded from progressive enrollment?

Steps to reproduce

1. Enable Passkeys in WorkOS Dashboard (staging)
2. Enable Magic Auth as the authentication method
3. Sign out an existing OTP-only user (no password)
4. Sign back in via magic link
5. Expected: "Create a passkey" progressive enrollment prompt
6. Actual: No prompt, goes straight to the app

Environment

• Staging environment
• @workos-inc/authkit-nextjs (Next.js 16 / App Router)
• Tried on both localhost:3001 and Vercel preview deployment
• No custom AuthKit domain configured (staging uses default *.authkit.app)

Questions

1. Does progressive enrollment only target password-based users? Is there a way to prompt OTP/magic-link users to enroll a passkey?
2. If not via progressive enrollment, is there another mechanism to offer passkey creation to existing OTP users (e.g., a widget, API call, or redirect)?