Sign in with a passkey
A passkey lets you sign in to Hypervalent Studio with your fingerprint, your face or your device PIN instead of a password. It is a key pair created by your device or password manager. The private half never leaves the device, and Studio keeps only the public half. Nothing secret crosses the network, and a passkey works only on Studio's own site, so a look-alike page cannot phish it.
A passkey is two factors in one: the device you hold, plus the fingerprint, face or PIN that unlocks it. Studio therefore never asks for an authenticator code after a passkey sign-in, even when two-factor authentication is on.
Add a passkey
- In Studio, open Account → Security and find the Passkeys section.
- Select Add a passkey.
- If your account has a password, confirm it. If two-factor authentication is on, Studio also asks for a code from your authenticator app. Accounts that sign in only with Google or Microsoft skip this step.
- Your browser or password manager asks where to save the passkey and to verify you with a fingerprint, face or PIN.
The new passkey appears in the list, named after the browser and device you added it from, for example "Chrome on macOS". You get an email whenever a passkey is added to your account.
You can add up to 10 passkeys. Add one on each device you use, or keep one in a password manager that syncs across your devices.
Synced passkeys and security keys
Passkeys saved in iCloud Keychain, Google Password Manager or another syncing password manager are available on all your devices signed in to that account. Studio marks them Synced. A hardware security key works too, as long as it can store a passkey (FIDO2 with a PIN). Older keys that only do U2F second-factor sign-in are not supported.
Sign in
On the sign-in page, select Sign in with a passkey and choose your passkey when the browser asks. You don't need to type your email first.
In browsers that support passkey autofill, selecting the Email field also lists your saved passkeys among the suggestions. Pick one to sign in straight away.
A passkey also works on an invite link. When an invite is for an account you already have, sign in with your passkey on the invite page and you join the organization.
If a page asks for your password specifically, a passkey cannot stand in for it. This happens, for example, when you confirm that a Google or Microsoft account should be connected to your Studio account.
Rename or remove a passkey
Each passkey in Account → Security → Passkeys shows when it was added and when it was last used.
- Rename gives it a name you'll recognise, such as "Work laptop".
- Remove stops it from signing in to Studio. You get an email whenever a passkey is removed. Removing it in Studio does not delete it from your device or password manager, so delete it there too.
You can't remove a passkey that is your only way to sign in. If your account has no password and no connected Google or Microsoft account, Studio disables Remove on your last passkey. Set a password or connect a provider first. The rule works the other way too: while you have a passkey, you can disconnect your last sign-in provider.
Passkeys and two-factor authentication
Two-factor authentication protects password and provider sign-ins with a code from an authenticator app. A passkey sign-in already proves two factors, so it goes straight in with no code. Keep two-factor authentication on for the times you sign in without a passkey.
A passkey also signs you in while your account is temporarily locked after too many wrong passwords. The lock exists to stop password guessing, and a passkey sign-in involves no password.
If you lose a device
Sign in another way: with a passkey on another device, a synced passkey, your password, or a connected provider. Then open Account → Security → Passkeys and remove the passkey from the lost device. If you get an email about a passkey you didn't add, remove that passkey and secure your account.
Troubleshooting
There's no passkey button. The browser does not support passkeys. The Passkeys section on Account → Security says so too. Update the browser or use another one.
The browser says no passkeys are available. The passkey was saved on another device or in another password manager. Most browsers offer to use a phone instead: scan the QR code with the phone that holds the passkey.
"This passkey is already registered to your account". The device or password manager you chose already holds a passkey for your account. Use that one, or pick a different device.
"This passkey request has expired". Each sign-in or add request is good for five minutes and can be used once. Start again from the button.
A passkey stopped working. A passkey belongs to the Studio address where it was created, studio.hypervalent.io. It does not work on any other address. If it was removed in Studio, sign in another way and add a new one.