Passkeys
A passkey answers the second-factor prompt with whatever already unlocks your device — Touch ID, Face ID, Windows Hello, or a hardware security key — instead of a code from an authenticator app. You still start by entering the code emailed to you.
What a passkey is
When you register one, your device generates a key pair. It keeps the private half and hands the console the public half. Signing in proves you hold the private key without sending anything reusable, so there is no shared secret to phish and no code to mistype.
Passkeys are bound to the site that created them, so a passkey registered in the Superheat console works only there.
| Passkey | Authenticator app | |
|---|---|---|
| What you do at the second factor | Approve a device prompt | Type six digits |
| Secret you could leak | None to type | The code, and the enrollment secret |
| Works on a new device | Only if your passkeys sync | Yes, if you scan the QR on both |
Register a passkey
- Go to Settings → Passkeys and select Add passkey.
- Your browser prompts for the fingerprint, face, PIN, or security key it is configured to use. Approve it.
- The passkey appears in the list with the date it was added.
If you dismiss the browser prompt, nothing is registered — select Add passkey again. If the card reads "This browser doesn't support passkeys", the browser has no WebAuthn support; use a different browser or an authenticator app instead.
Register a passkey on each device you sign in from, unless your passkeys sync through iCloud Keychain or a password manager. You can hold several at once.
Use it instead of a code
After your email code, the console shows the second-factor screen. Choose Use a passkey instead, approve the browser prompt, and you land in the dashboard.
That button appears only when you have a passkey registered. If a passkey is the only factor you enrolled, the screen still renders a six-digit field — leave it empty and use the button.
Remove a passkey
The trash icon next to a passkey removes it. Removing it does not end the current session. If it was your only factor, the account goes back to single-factor email sign-in.
Losing the device that holds your only passkey locks you out: the console still asks for a second factor and you have no way to answer. Add a second passkey, or enroll an authenticator app, before you depend on one device.