This doesn't look all that hard: https://github.com/mkalioby/django-passkeys https://github.com/mkalioby/django-passkeys but I guess it depends on how low-level

This doesn't look all that hard: https://github.com/mkalioby/django-passkeys https://github.com/mkalioby/django-passkeys but I guess it depends on how low-level your backend is. I would personally separate auth and the application. Configuring something like Keycloak or Authelia or one of the many other alternatives to do all the difficult work for you and just logging in through SSO/SAML seems much easier than having to keep track of your own authentication rules/security hashes/salting/etc. without making a mistake.