Setting up passkeys and two-step verification

Before you start

• ✓A device with a screen lock (fingerprint, face, or PIN) for a passkey, or an authenticator app on your phone.

Why it matters

Sensitive changes, such as transferring ownership, changing your email, archiving or deleting a Workspace, deleting a Project, and managing payments, ask for a recent passkey or authenticator check. Email codes and recovery-code sessions can’t approve them.

Once the authenticator app is on, every sign-in, whether with an email code, Google, or a passkey, also asks for a second step: your authenticator code, a passkey you didn’t sign in with, or a recovery code.

You can save up to 10 passkeys. Your only strong method can’t be removed until you add another.

Steps

1. Add a passkey

   1

   Step 1: Open Sign-In & Security

   Open the account menu at the bottom of the sidebar, choose Account, then Sign-In & Security.

2. 2

   Step 2: Choose Add Passkey

   Confirm with your device’s fingerprint, face, or PIN, then give the passkey a name you’ll recognise. Prooflin never sees your biometric data.

3. Set up an authenticator app

   3

   Step 3: Choose Set Up

   Under Two-Step Verification, choose Set Up next to Authenticator app. Scan the QR code with any standard authenticator app, or enter the key manually.

4. 4

   Step 4: Turn it on

   Enter the app’s current 6-digit code and choose Turn On. Nothing is enabled until a code is verified.

5. 5

   Step 5: Save your recovery codes

   After your first passkey or authenticator app, Prooflin shows 10 recovery codes once. Save them somewhere safe; Prooflin never emails them. Then tick I’ve saved these codes somewhere safe.

What you should see

Common problems

Next steps

• HELP ARTICLESigning in with a recovery code and restoring full accessIf you can’t use your passkey or authenticator app, a recovery code gets you back in. That session is restricted until you re-secure it with an existing passkey or authenticator.→
• HELP ARTICLESigning in with an email code, a passkey, or GoogleProoflin is passwordless. Sign in with a one-time code sent to your email, a passkey saved on your device, or Google. If two-step verification is on, Prooflin asks for a second step.→
• CONTACTContact UsIf this article didn’t resolve your question.→