Mercari shares how they bridged the gap between password-dependent accounts and fully passkey-only accounts using a credential migration spectrum and risk-based authentication. Rather than forcing an all-or-nothing switch, they model accounts across four states — from password/email link through to passkey-only — and use session and account risk postures to progressively disable weaker factors. Email magic links serve as an intermediate step that removes passwords without requiring passkeys immediately. Risk signals are weighted asymmetrically depending on which factor is being disabled. The same approach is applied to both login and account recovery flows, ensuring recovery never restores passwords. Future plans include passwordless registration for new accounts and eventually mandating passkeys as societal familiarity grows.
