Devices
Your passkeys
Each passkey lives on one device (a phone, a laptop, a hardware key). Any active one signs you in and signs for your own account. Keep at least two, on different devices: then losing one is an inconvenience, not a lock-out.
| Name | Key | Status | Last used |
|---|
Add a passkey
Create a passkey on another device or a hardware key, then confirm it with a passkey you already use. The confirmation is a signature over exactly that new key; it is recorded in the key registry and shows in your evidence pack. Your other devices get a notification.
On this computer the browser may offer "use a phone or tablet" (QR code) or a security key: choose the device that should hold the new passkey.
Mandates signed by a removed passkey
They stay valid: each signature was good when it was recorded, and the evidence pack still verifies. If you do not trust them any more (for example the phone was stolen while unlocked), revoke them here with a current passkey: one signature per 20 mandates.
Honest limits
- Removing a passkey stops it at once on this service: it cannot sign in, approve or sign anything. It does not erase it from the lost device.
- Removing does not undo what it signed before. That is on purpose: a third party can still check old mandates.
- In a team, the policy names one key per person. A new passkey signs for the team only after the other members replace your key (Team page).
- Agent API keys are separate from passkeys: if you think someone used your session, also recreate the agents' keys.