> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vumasign.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Passkeys

> Use a passkey as the second step when you sign in to Vumasign: what it is, how to add one, and what happens if you lose it.

export const secondFactorCodesPerWindow = "5";

export const recoveryCodeCount = "10";

export const passkeyTriesWindow = "quarter-hour of the clock (:00, :15, :30, :45)";

export const passkeyTriesPerWindow = "10";

export const passkeyLimit = "10";

export const passkeyFreshSession = "10 minutes";

A passkey is a sign-in credential kept by your device or your password manager. You unlock it with
your fingerprint, your face or your screen lock. In Vumasign, a passkey is one way to complete
**two-step verification**. The authenticator app is the other.

This page is about the people who sign in to Vumasign: you and your colleagues. Signers never need a
passkey. To check who a signer is, see [signer verification](/concepts/signer-verification).

## What a passkey replaces, and what it does not

Signing in to Vumasign has two steps:

1. **Who you are.** You use your password, Google, or your organisation's identity provider.
2. **That it is really you.** If you have turned on two-step verification, you then prove it.

A passkey is for the second step. You can use it **instead of a code** from an authenticator app.

A passkey does **not** replace the first step. You still sign in with your password, Google or
single sign-on first. Signing in with only a passkey, with no password, is not available.

You can have passkeys, the authenticator app, or both. When you have both, the second step lets you
choose. A [recovery code](#recovery-codes) works at the second step as well.

## Why use one

* **A look-alike site cannot use it.** Your browser offers a passkey only to the site it was made
  for. A page pretending to be Vumasign at another address cannot ask for it.
* **Vumasign checks where it was used.** Vumasign accepts a passkey only when your browser reports
  that it was used on the Vumasign app itself. A passkey used on any other page, even one on a
  Vumasign address, is refused.
* **There is nothing to type.** A code from an authenticator app can be read over your shoulder,
  or typed into the wrong page. A passkey never leaves your device or password manager.
* **Vumasign holds no secret for it.** Vumasign keeps only the passkey's public half, which can
  check a sign-in but cannot make one.

Each time you use a passkey, it asks you to unlock it with your fingerprint, face, PIN or screen
lock. Vumasign refuses a passkey that was used without that check.

## Adding a passkey

### When Vumasign offers one

Right after you sign in, Vumasign may ask whether you would like to add a passkey for this device.
It asks only when all of these are true:

* Passkeys are available on Vumasign at the time.
* You signed in with a password or Google. Signing in through your organisation’s identity provider does not bring the offer.
* You did not sign in through break-glass.
* You have just signed in. The offer is shown only in the first minutes of a session.
* The organisation you signed in to does not require single sign-on.
* You have no passkey yet.
* You have not turned the offer down before.

It also asks only if your device has a built-in way to unlock a passkey, such as Touch ID, Face ID,
Windows Hello or a phone's screen lock.

**If you say no, or close the question, Vumasign does not ask again.** You can still add a passkey
whenever you like in Settings.

### From Settings

Go to **Settings**, then **Sign-in security**. Under **Passkeys**, give the new passkey a name (such
as "Work laptop") and choose **Add a passkey**. Your browser or device then asks you to create it.

You can have up to {passkeyLimit} passkeys. If you use several devices, add a passkey on each, or use a
passkey that your password manager keeps in step across your devices. The list shows which kind each
passkey is: **Synced across your devices** or **On one device**.

### Proving it is you first

Adding or removing a passkey changes how your account is protected, so Vumasign checks it is you.

* **If you signed in within the last {passkeyFreshSession},** that sign-in is enough.
* **If not,** you are asked to confirm with one of your passkeys, a code from your authenticator
  app, or a recovery code.
* **If you have no two-step verification yet, and you signed in longer ago,** sign out, sign back
  in, and add the passkey straight away.

This means somebody who finds your computer unlocked cannot quietly add a passkey of their own.

## Recovery codes

If you add a passkey when you have no two-step verification yet, it comes with {recoveryCodeCount} recovery
codes. They are shown **once**. Save them somewhere safe, away from the device. If the authenticator
app is already on, you keep the codes you got with it.

A recovery code gets you past the second step when you cannot use your passkey, for example after
you lose your phone. Each code works once.

**To get new codes,** go to **Settings**, then **Sign-in security**, and choose **Replace recovery
codes**. You prove it is you first, as above. You get {recoveryCodeCount} new codes, and the old ones stop
working at once.

Your codes stay valid for as long as you have any form of two-step verification. If you turn the
authenticator app off but still have a passkey, they keep working. When you remove your last passkey
and the authenticator app is off, the codes are deleted. You have no second step left for them to
stand in for.

## If you lose a device

1. Sign in with your password or Google as usual.
2. At the second step, use another passkey, your authenticator app, or a recovery code.
3. Go to **Settings**, then **Sign-in security**, and remove the passkey for the lost device. Add a
   passkey on your new device.

If your lost passkey was synced by a password manager, it may still be on your other devices. Remove
it only if you think somebody else might now have access to it.

## What you and your organisation are told

* **You get an email** each time a passkey is added to or removed from your account, and each time
  your recovery codes are replaced. If it was not you, the email says what to do. These emails have
  no links in them, so a fake one is easier to spot.
* **Each organisation you belong to records it.** Adding or removing a passkey is recorded in every
  organisation you belong to, since your sign-in protects your access to all of them. The record says
  only that a passkey was added or removed, and whether it is synced. Owners and admins see it in
  **Recent activity**, under **Settings**, **Single sign-on**.

## How many tries

You can use a passkey {passkeyTriesPerWindow} times in each {passkeyTriesWindow}. Every try counts, including the
ones that work. Passwords and Google, and each identity provider, have separate counts.

Passkey tries do **not** use up the {secondFactorCodesPerWindow} codes you can enter in the same time. If you
run out of passkey tries, you can still use the authenticator app or a recovery code.

## Single sign-on and break-glass

If you sign in through your organisation's identity provider and you have two-step verification,
you are asked for it as well. A passkey works there just as it does after a password. Vumasign does
not offer to add a passkey after a single sign-on sign-in. Add one in Settings instead.

If your organisation requires single sign-on, its owners can still get in when the identity
provider is down, through [break-glass](/guides/single-sign-on#require-single-sign-on).
To do this, an owner needs two-step verification. A passkey counts, and so does the authenticator
app. Every owner is emailed each time break-glass is used, and the email says which one the owner
used.

So that your organisation can always get back in, the last owner who could break glass cannot
remove a passkey that is their only two-step verification while single sign-on is required. To
remove it, they must first add another passkey or turn on the authenticator app.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.