Signing in to a developer portal

Each API on MicroAuth has its own developer portal, where you sign up, create keys and pay. The first part of this page is for the people who use those portals. The last part is for the API owners who run them.

Your account on each portal is separate, and so is its security. A passkey or authenticator app entry you set up on one portal doesn't work on another portal, or on the MicroAuth dashboard. You'll find everything below on the portal's Account page, under Sign in and security.

Passkeys

A passkey signs you in with your fingerprint, your face or your screen lock instead of a password. Your device or password manager keeps the private key, and the portal only stores the matching public key.

• Add one with Add a passkey. Confirm it's you if you're asked, then follow your browser's prompt. We email you when a passkey is added or removed.
• Sign in with Sign in with a passkey on the sign in page, or pick your passkey from the email field's suggestions. A passkey never asks for a two step code.
• Rename or remove passkeys from the list. It shows whether each one is synced to your other devices or stays on one device, and when it was last used.

A passkey only works on the exact address where you made it. If the portal has two addresses, such as weather.microauth.dev and developers.example.com, add a passkey on the one you use. The list marks passkeys made on the other address.

Two step verification

Two step verification asks for a 6 digit code from an authenticator app after your password.

1. Click Set up two step verification and confirm it's you if you're asked.
2. Scan the QR code with an app such as 1Password, Google Authenticator or Authy, or type in the setup key. The app shows the entry under the API's name.
3. Enter the code from the app, then save your recovery codes.

When you sign in with your password, the portal then asks for a code. Use a passkey instead works too if you have one. To turn it off, click Turn off, confirm it's you and enter your password.

Recovery codes

You get 10 recovery codes when you turn on two step verification. Each one signs you in once if you lose your phone. They're shown only once, so copy or download them and keep them safe. The card warns you when 3 or fewer are left, and Replace recovery codes gives you a fresh set.

Confirming it's you

Adding or removing a passkey, turning two step verification on or off and replacing recovery codes need a quick check, unless you did one in the last 10 minutes. Use a passkey, a code from your app or a recovery code. While two step verification is off, a code sent to your email works too.

Locked out

If you lost your authenticator app and your recovery codes and have no passkey, ask the API's team to reset your sign in. Their support address is in the portal's footer. They'll want to check it's really you first. After the reset you sign in with your password, or reset it, and can set things up again.

For API owners

Your customers set up passkeys and two step verification themselves on the portal. Everything they see carries your API's name, including the entry in their authenticator app and the security emails.

Resetting a customer's sign in

Open the customer under Customers. Portal users shows who has two step verification on and how many passkeys each person has. Reset two step verification next to a person:

• turns off two step verification and deletes their recovery codes
• removes all their passkeys
• signs them out everywhere
• emails them to say their sign in was reset

They can then sign in with their password, or reset it, and set things up again. Resetting needs the admin or owner role in your workspace and is recorded in the activity log. Only do it once you're sure the request comes from them, for example by writing to the email address on their account and waiting for an answer.

When your portal address changes

Passkeys belong to the exact address they were made on. If you change your portal address or your custom domain, passkeys made on the old address stop working there. Your customers sign in with their password and add a new passkey. Passwords, two step verification and recovery codes keep working.