Passkeys

A passkey lets your device confirm that it’s you before you use admin access. Hephaestus still uses your connected sign-in provider to identify your account. Your ordinary member access never needs a passkey.

Passkey protection

Your instance or your workspace can require a passkey for administration. You cannot turn off a required policy in your personal settings.

Adding your first passkey also turns on Personal admin protection for you, even when your instance makes passkeys optional. You can turn it off in Passkeys. Turning it off does not remove an instance or workspace requirement.

Your device confirms the passkey with its screen lock, fingerprint, or face recognition. Hephaestus does not receive that biometric data. Use a current browser over a secure connection.

Sensitive changes need a recent confirmation. When your confirmation has lapsed, Passkeys shows Verify passkey. Select it before you add another passkey, create recovery codes, remove a passkey, or change Personal admin protection.

Confirm admin access

When an admin page or action needs a passkey, Hephaestus opens a short confirmation page.

1. Select Confirm with passkey.
2. Follow your browser’s prompt.

Hephaestus takes you back to the page you were on. If you were in the middle of a change, make it again. Hephaestus does not repeat a refused action automatically.

If you do not have a passkey yet:

1. Select Add passkey.
2. Follow your browser’s prompt.
3. Select Confirm with passkey, and follow the prompt again.

To leave without confirming, select Not now.

Add a passkey

1. Open User settings and find Passkeys.
2. Optional: Enter a Passkey name, such as the name of the device. Without a name, the passkey shows the date you added it.
3. Select Register passkey.
4. Follow your browser’s prompt.

The passkey appears in the list. Adding a passkey signs you out of your other sessions. Add a second passkey on another device, so you keep admin access if you lose one.

Create new recovery codes

Recovery codes let you replace your passkeys if you lose every device.

1. In Passkeys, select Verify passkey if it appears, and follow your browser’s prompt.
2. Select Create new recovery codes, then Create codes.
3. Select Copy codes, and store the codes in a safe place outside the browser.

Hephaestus shows the codes only once. New codes make all earlier codes invalid. Each code works once.

Remove a passkey

1. In Passkeys, select Verify passkey if it appears.
2. Select Remove next to the passkey.
3. Select Remove passkey.

The passkey stops working, and your other sessions end.

To remove your last passkey:

1. Turn off Personal admin protection.
2. Select Remove next to the passkey.
3. Select Remove last passkey.

Removing your last passkey also deletes your recovery codes and signs you out of your other sessions. You keep your ordinary access. Admin access that your instance or a workspace protects with passkeys stays locked until you add and verify a new passkey. You cannot remove your last passkey during recovery.

Recover access

If you lose your passkeys, use a recovery code.

1. Sign in through your usual provider and open User settings.
2. In Passkeys, open Recover passkeys.
3. Enter a Recovery code.
4. Select Start recovery, and confirm with Start recovery.

Recovery removes your old passkeys, signs out your other sessions, and makes your other recovery codes invalid. It does not restore admin access. To get it back, add a passkey and verify it, add a second passkey, and create new recovery codes.

Troubleshooting

The browser prompt closed or failed

Try again from the same page.

You have no passkey and no recovery code

Contact your instance operator. A workspace admin cannot reset your passkeys.