[jeroenhd]

This doesn't look all that hard: https://github.com/mkalioby/django-passkeys but I guess it depends on how low-level your backend is.

I would personally separate auth and the application. Configuring something like Keycloak or Authelia or one of the many other alternatives to do all the difficult work for you and just logging in through SSO/SAML seems much easier than having to keep track of your own authentication rules/security hashes/salting/etc. without making a mistake.

[notatoad]

if the solution is introducing a whole new third-party authentication provider to my existing app, i'd say that definitely counts as hard.