Passkeys and two step verification

Your password is one way into your MicroAuth account. Passkeys and two step verification make the account much harder to take over, even if your password leaks. Both are optional and you can use both at once. They live on the Account page, under Sign in and security.

Passkeys

A passkey lets you sign in with your fingerprint, your face, or the PIN you use to unlock your device, instead of typing a password. Your device or password manager keeps a private key that never leaves it, and MicroAuth only stores the matching public key. A passkey only works on the site it was made for, so a look alike sign in page can't use it.

Add a passkey

1. Open Account and click Add a passkey under Sign in and security.
2. Confirm it's you if you're asked.
3. Follow your browser's prompt. It may offer to save the passkey on your phone, your computer, a security key or a password manager such as iCloud Keychain, Google Password Manager or 1Password.

The new passkey is named after the app that holds it, like "iCloud Keychain", or just "Passkey" when the app doesn't say. Click Rename to give it a name you'll recognize. You can have up to 20, so add one for each device or password manager you use. We email you whenever a passkey is added.

If your browser can't make passkeys, the card says so and hides the button.

Sign in with a passkey

On the sign in page, click Sign in with a passkey, or click the email field and pick your passkey from the suggestions. You're signed in straight away. A passkey already proves you have your device and unlocked it, so it never asks for a two step code.

If you pick a passkey that was removed from your account, the page says it isn't set up for this account anymore. Sign in with your password, then add it again. Browsers that support it also hide the old passkey for you.

The list

Each passkey on the card shows:

• Synced when its password manager backs it up to your other devices, or This device only when it lives on one device or security key
• when it was added and when it was last used

Remove deletes a passkey from your account. It stops working right away and we email you. It stays in your password manager until you delete it there, although browsers that support it hide it for you.

Passkeys for the dashboard only work on the dashboard. Each developer portal is a separate site with its own passkeys. See signing in to a portal.

Two step verification

Two step verification asks for a 6 digit code from an authenticator app after your password, so a stolen password isn't enough to get in.

Turn it on

1. Click Set up two step verification under Sign in and security, and confirm it's you if you're asked.
2. Scan the QR code with an authenticator app such as 1Password, Google Authenticator or Authy. If you can't scan it, type the setup key into the app instead. It's shown in groups of four to make that easier.
3. Enter the 6 digit code the app shows and click Turn on.
4. Save your recovery codes, tick I saved these codes somewhere safe and click Done.

We email you whenever two step verification is turned on or off.

Signing in

After your password, enter the code from your app. If you have a passkey, Use a passkey instead finishes signing in without the code, and Use a recovery code instead takes one of your saved codes. Signing in with a passkey from the start skips this step.

Turn it off

Click Turn off, confirm it's you, then enter your password. Your app and your recovery codes stop working for this account, and signing in only needs your password or a passkey again.

Recovery codes

When you turn on two step verification you get 10 recovery codes. Each one signs you in once in place of a code from your app, for example after you lose your phone. They're shown only once, so copy or download them and keep them somewhere safe, such as your password manager.

The card shows how many codes you have left and warns you once you're down to 3 or fewer. Replace recovery codes gives you 10 new ones and the old ones stop working right away. We email you when that happens.

Confirming it's you

Adding or removing a passkey, turning two step verification on or off and replacing recovery codes all change how you sign in. MicroAuth asks you to confirm it's you first, unless you already did in the last 10 minutes. Renaming a passkey doesn't ask. Transferring an API or a workspace asks too, because it hands over everything in it.

You can confirm with:

• one of your passkeys
• a code from your authenticator app, or a recovery code, when two step verification is on
• a code we email you, but only while two step verification is off, so your inbox alone never replaces your second step

Signing in counts as confirming when it used a passkey, a password and a code, or an emailed code at sign up, password reset or an invite. Signing in with only a password doesn't, so you're asked once after that.

If you lose access

• Lost the phone with your authenticator app? Sign in with a passkey or a recovery code, then turn two step verification off and on again with your new phone.
• Lost a device with a passkey? Sign in another way and remove that passkey. A synced passkey is still on your other devices.
• Lost everything? Resetting your password doesn't turn off two step verification. Contact us from the email address on your account.

Sessions

Sessions on the Account page shows how each browser signed in: Password, Password and code, Passkey or Email code. If you don't recognize one, sign it out and change your password.