# Passkeys

Sign in to the panel with your device's fingerprint, face recognition or PIN, without a password. Register a passkey on each device you use. Once a passkey is registered, the password is no longer accepted.

Each user manages only their own passkeys. A passkey is valid for all of the user's Glass Data accounts.

## How it works

The passkey is an open standard from the [FIDO Alliance](https://fidoalliance.org/passkeys/), adopted by the main operating systems and browsers. Google, Apple and Microsoft accounts, for example, use the same standard.

At registration, the device creates a pair of cryptographic keys. The private key stays on the device, or in the password manager that syncs it, such as iCloud Keychain or Google Password Manager. Glass Data stores only the public key, which on its own does not give access to the panel.

At sign-in, the device confirms your identity by fingerprint, face or PIN and signs a challenge sent by the panel. No secret travels over the network or is stored at Glass Data. The passkey works only for the Glass Data address. A fake page imitating the panel cannot use it.

For passkeys in general, see [Sign in with a passkey instead of a password](https://support.google.com/accounts/answer/13548313?hl=en), in Google's help.

## Register a passkey

1. Click the avatar at the top of the sidebar, then **Personal settings**.
2. Under **Passkeys**, click **Manage passkeys**.
3. Click **Add passkey**.
4. In **Name**, identify the device, such as "Laptop" or "Phone".
5. Click **Create passkey** and confirm on the device.

If your last sign-in to the panel was more than 5 minutes ago, the panel asks you to [confirm your identity](#confirm-identity) before registering.

Registering ends the sessions open in other browsers and devices. From then on, the **Password** section is no longer shown in **Personal settings**.

Register a second passkey on another device, such as your phone or a security key. With a single passkey, losing the device requires [access recovery](#recover-access).

## Sign in to the panel

1. Enter your email and click **Continue**.
2. If the email has a registered passkey, the browser asks for confirmation on the device. Otherwise, the panel asks for the password.

If the confirmation fails or is cancelled, the panel shows **Try again** and **Lost your passkey?**. The panel does not offer the password as an alternative to a user who has a registered passkey.

## Confirm identity

Registering and removing a passkey require a sign-in to the panel within the last 5 minutes. After that, the panel shows the **Confirm identity** screen:

| User's situation         | Confirmation                                |
| :----------------------- | :------------------------------------------ |
| Has a registered passkey | **Confirm with passkey**, on the device     |
| Has no passkey           | **Password**, followed by **Confirm**       |

## Remove a passkey

In **Personal settings > Manage passkeys**, click **⋮ > Remove** on the passkey's row and confirm. The removed passkey stops working immediately, and the sessions open in other browsers and devices are ended.

Once the last passkey is removed, the previous password is accepted again. The **Password** section is shown again in **Personal settings**.

The **Your passkeys** list shows, for each passkey:

- **Name**: the name entered at registration;
- **Added**: how long ago the passkey was registered;
- **Last used**: how long ago the passkey was used to sign in, or **Never used**.

## Recover access

If you lose the device with your only passkey:

1. On the panel's sign-in page, click **Lost your passkey?**.
2. Enter your email. Glass Data sends the **Access recovery** email.
3. In the email, click **Create passkey**.
4. In **Name**, identify the new device and click **Create passkey**.

Registering the new passkey completes the sign-in to the panel. The link in the email is valid for 6 hours and for a single use. An expired or already used link shows **Request a new link**.

Recovery creates a passkey and does not restore the password. Passkeys already registered remain valid: remove the lost device's passkey after signing in.

## Email notices

| Email               | When it is sent                                          |
| :------------------ | :------------------------------------------------------- |
| **Passkey added**   | when a passkey is registered, with its name and the date |
| **Passkey removed** | when a passkey is removed                                |
| **Access recovery** | when recovery is requested, with the link to a new passkey |

If you receive a notice of a change you did not make, contact Glass Data immediately.