Passkeys
Sign in with Face ID, Touch ID, Windows Hello, or a hardware security key, no password to type.
What a passkey is
A passkey is a credential stored on your device (or your password manager) using the WebAuthn standard. It's phishing-resistant: it only ever works on this app's real domain, so it can't be tricked into signing in on a look-alike site the way a typed password can.
Required account protection
Accounts with a password must enable an authenticator app (TOTP) before checkout, billing changes, reports and exports, sharing, API keys and MCP, bank or ledger connections, team changes, email or password changes, sender allowlist changes, and callback secrets. This also applies with a linked passkey or Google sign-in. Accounts without a password keep their existing protection rules. The free first look stays open: verify your email, sign in, upload or email in your first statement, review merchants and rules, preview My year and the locked report, view pricing, or edit your profile name. You can sign out or delete your account without TOTP; deletion keeps its existing identity check.
Adding one
If your account has a password, complete authenticator setup before adding a passkey. In Dashboard, open Settings, then Security, then Passkeys. Choose "Add a passkey" and follow your browser's own prompt (Face ID, Touch ID, Windows Hello, or a security key). You can add more than one, from different devices.
Signing in with a passkey
On the sign-in page, choose "Sign in with a passkey" instead of entering a password. Your browser or password manager shows you which registered passkey to use.
As a second factor
If your account also has two-factor authentication on, a passkey can stand in for a TOTP code at the challenge step, see the two-factor authentication page.
Removing one
- Accounts with a password require completed authenticator setup before removing a passkey.
- Requires a step-up check (a fresh password, code, passkey, or linked provider sign-in), see Sessions and devices.
- Adding or removing a passkey does not exempt password sign-in from account protection. The free first look and account deletion remain available, with the existing identity check for deletion.