Skip to main content
Passkeys and security keys let you sign in with your device, password manager, or hardware key. They can also be used as the second factor after signing in with email and password. When passkey login is enabled, people with a registered passkey can skip email/password and sign in directly with Sign in with a passkey. Sure requires user verification for that flow, so the passkey acts as possession plus biometric or device PIN verification. If passkey login is disabled, registered passkeys still work as an MFA method. In that mode, people sign in with their account credentials first, then use the passkey or security key to complete two-factor verification.

​
Before you start

You need:
  • Two-factor authentication enabled on your Sure account
  • A browser that supports WebAuthn passkeys or security keys
  • A passkey-capable device, password manager, Touch ID, Windows Hello, or hardware security key
Self-hosted admins should configure the WebAuthn relying party settings before users register passkeys. See Self-hosting configuration.

​
Add a passkey or security key

  1. Go to Settings → Security.
  2. Enable 2FA if it is not already enabled.
  3. Find Passkeys and security keys.
  4. Enter a recognizable key name, such as “MacBook Touch ID” or “YubiKey”.
  5. Enter your current authenticator code or an unused backup code.
  6. Select Add passkey or security key.
  7. Follow your browser, operating system, password manager, or hardware key prompt.
Sure checks the code before asking your browser to create the passkey. This prevents a stolen session cookie from registering a new passkey. If the code is wrong or has already been used, Sure rejects the request before the browser prompt runs, so no authenticator slot is used up. A backup code is consumed only when the passkey is successfully saved. Cancelling the browser prompt does not spend it. After registration succeeds, the key appears in the Passkeys and security keys list with its creation date.

​
Sign in with a passkey

If passkey login is enabled:
  1. Go to the Sure sign-in page.
  2. Select Sign in with a passkey.
  3. Complete the browser prompt with the same passkey, device, or hardware key you registered.
To use a passkey as a second factor:
  1. Sign in with your Sure account as usual.
  2. When Sure asks for two-factor verification, select Use passkey or security key.
  3. Complete the browser prompt with the same passkey, device, or hardware key you registered.
If you also have authenticator-app 2FA configured, you can still use a one-time code when a passkey is unavailable.

​
Remove a passkey

  1. Go to Settings → Security.
  2. In Passkeys and security keys, find the key you no longer want to use.
  3. Select Remove and confirm.
Removing a key only removes it from Sure. If the passkey is stored in your browser, operating system, password manager, or hardware key, manage that copy in the tool where it was created.

​
Self-hosting configuration

For self-hosted deployments, set stable WebAuthn relying party values before people register passkeys:
WEBAUTHN_RP_ID is usually the registrable domain, such as example.com, not a full URL and not a hostname with a port. WEBAUTHN_ALLOWED_ORIGINS is a comma-separated list of full origins where people access Sure, including scheme and host:
For local development, use:
Changing WEBAUTHN_RP_ID after people register credentials can make existing passkeys and security keys unavailable. Keep it stable across reverse proxy, domain, and hostname changes.
Passwordless passkey login is enabled by default:
Set it to false if you only want passkeys and security keys to work as an MFA method after email/password sign-in.

​
Upgrading an instance that already has passkeys

Passwordless sign-in is on by default, and it applies to passkeys that were registered before this feature existed. A passkey a user added purely as a second factor can, after the upgrade, sign that user in on its own. This applies to a credential only if the authenticator that holds it made it discoverable. Registration asks with residentKey: "preferred", which an authenticator is free to decline, and nothing in the database records what it decided — so Sure cannot tell you in advance which existing credentials are affected. Password managers and platform authenticators (Proton Pass, iCloud Keychain, 1Password, Bitwarden, Windows Hello) store discoverable credentials by default, so theirs generally are. A credential stored non-discoverably — such as one on a hardware key with no free resident-key slot — stays second-factor only. Nothing needs to be re-registered either way. The opt-out is instance-wide. There is no per-user or per-credential setting: to keep passkeys as a second factor for everyone, set AUTH_PASSKEY_LOGIN_ENABLED=false before upgrading. A single user can only opt out by removing the credential. This is not a reduction in security. The passwordless ceremony requires user verification, so the passkey alone is still two factors. It is a change in what an already-registered credential can do.

​
Browser autofill

When the browser supports conditional mediation, saved passkeys are offered from the email field’s autofill menu before any button is clicked. Browsers without that support fall back to the Sign in with a passkey button, which works the same way.