Skip to main content
Start Free Trial

Passkeys

Passkeys are a phishing-resistant replacement for passwords. Instead of typing a secret, you approve each sign-in with your device — a fingerprint, face scan, or device PIN. Incido supports passkeys for all dashboard accounts and lets organizations require them for every member.

How sign-in works with passkeys​

Signing in stays email-first: enter your email address, and the login page offers the right method for your account.

  • If you have registered passkeys, you can sign in with a passkey. While your account still has a password, both options are offered.
  • Once your account is passkey-only, the password step is skipped entirely.
  • If your email domain uses enforced SAML single sign-on, you are routed to your identity provider as usual — passkeys never override SAML.

Every passkey ceremony requires user verification: your device must confirm it is you (biometrics or PIN). Passkey providers that skip user verification are rejected.

Registering passkeys​

Open Profile → Passkeys in the user menu. You can register up to 5 passkeys and rename or remove them at any time.

Adding a second passkey removes your password

When you add your second passkey, your password is permanently removed and password sign-in becomes impossible for your account. This is what makes the setup secure — there is no weaker fallback left to attack. The dashboard explains this before the second passkey is created.

The two passkeys must be independent of each other, so losing one device does not lock you out while an attacker cannot reuse a single synced credential:

  • either both passkeys are device-bound (they never leave the device), or
  • they are created with different passkey providers or security keys.

After your password is removed, password reset and "set password" emails are disabled for your account. Keep both passkeys available; if you lose access to all of them, contact your organization admin.

Requiring passkeys for your organization​

Organizations on plans with the Passkey Enforcement feature can require passkeys for all members: open Organization settings and enable Require passkeys. Enabling and disabling the requirement is recorded in the organization audit log.

When enforcement is active:

  • Every member must register two independent passkeys before they can continue using the dashboard. Members who are not yet enrolled are taken to their Profile → Passkeys page on their next sign-in and continue to where they were heading once enrollment is complete.
  • The requirement follows the user, not the organization: a member of one enforcing organization must use passkeys in every organization they belong to.
  • Invited users complete registration first and are then required to set up their passkeys before using the dashboard.

Google sign-in under enforcement​

Google social sign-in stays available, but it no longer signs you in on its own:

  • Members who have not enrolled yet are taken to their Profile → Passkeys page after signing in with Google.
  • Enrolled members confirm each Google sign-in with a passkey. Google only saves you from typing your email address — the authentication itself is done by your passkey.

SAML and break-glass users​

SAML single sign-on offloads authentication to your identity provider, so members signing in through SAML are not asked for passkeys.

The exception is break-glass users — the designated accounts that may bypass enforced SAML sign-in. Because they can sign in without your identity provider, they are automatically required to use passkeys, exactly as if passkey enforcement were enabled. This ensures the emergency path is not the weakest link in a SAML-enforced environment.