# Passkeys

A passkey lets your device confirm that it’s you before you use admin access. Hephaestus still uses your connected sign-in provider to identify your account. Your ordinary member access never needs a passkey.

## Passkey protection

Your instance or your workspace can require a passkey for administration. You cannot turn off a required policy in your personal settings.

Adding your first passkey also turns on **Personal admin protection** for you, even when your instance makes passkeys optional. You can turn it off in **Passkeys**. Turning it off does not remove an instance or workspace requirement.

Your device confirms the passkey with its screen lock, fingerprint, or face recognition. Hephaestus does not receive that biometric data. Use a current browser over a secure connection.

Sensitive changes need a recent confirmation. When your confirmation has lapsed, **Passkeys** shows **Verify passkey**. Select it before you add another passkey, create recovery codes, remove a passkey, or change **Personal admin protection**.

## Confirm admin access

When an admin page or action needs a passkey, Hephaestus opens a short confirmation page.

1. Select **Confirm with passkey**.
2. Follow your browser’s prompt.

Hephaestus takes you back to the page you were on. If you were in the middle of a change, make it again. Hephaestus does not repeat a refused action automatically.

If you do not have a passkey yet:

1. Select **Add passkey**.
2. Follow your browser’s prompt.
3. Select **Confirm with passkey**, and follow the prompt again.

To leave without confirming, select **Not now**.

## Add a passkey

1. Open **User settings** and find **Passkeys**.
2. Optional: Enter a **Passkey name**, such as the name of the device. Without a name, the passkey shows the date you added it.
3. Select **Register passkey**.
4. Follow your browser’s prompt.

The passkey appears in the list. Adding a passkey signs you out of your other sessions. Add a second passkey on another device, so you keep admin access if you lose one.

## Create new recovery codes

Recovery codes let you replace your passkeys if you lose every device.

1. In **Passkeys**, select **Verify passkey** if it appears, and follow your browser’s prompt.
2. Select **Create new recovery codes**, then **Create codes**.
3. Select **Copy codes**, and store the codes in a safe place outside the browser.

Hephaestus shows the codes only once. New codes make all earlier codes invalid. Each code works once.

## Remove a passkey

1. In **Passkeys**, select **Verify passkey** if it appears.
2. Select **Remove** next to the passkey.
3. Select **Remove passkey**.

The passkey stops working, and your other sessions end.

To remove your last passkey:

1. Turn off **Personal admin protection**.
2. Select **Remove** next to the passkey.
3. Select **Remove last passkey**.

Removing your last passkey also deletes your recovery codes and signs you out of your other sessions. You keep your ordinary access. Admin access that your instance or a workspace protects with passkeys stays locked until you add and verify a new passkey. You cannot remove your last passkey during recovery.

## Recover access

If you lose your passkeys, use a recovery code.

1. Sign in through your usual provider and open **User settings**.
2. In **Passkeys**, open **Recover passkeys**.
3. Enter a **Recovery code**.
4. Select **Start recovery**, and confirm with **Start recovery**.

Recovery removes your old passkeys, signs out your other sessions, and makes your other recovery codes invalid. It does not restore admin access. To get it back, add a passkey and verify it, add a second passkey, and create new recovery codes.

## Troubleshooting

### The browser prompt closed or failed

Try again from the same page.

### You have no passkey and no recovery code

Contact your instance operator. A workspace admin cannot reset your passkeys.