Passkeys

What is a passkey?

A passkey is a modern, highly secure way to sign in without typing a password. Instead of remembering a password and entering a two-factor code, you unlock your account using something already built into your device — your fingerprint, face recognition, screen PIN, or a hardware security key.

Passkeys are phishing-resistant: the secret never leaves your device, is never sent to us, and cannot be reused on a fake website. Because unlocking the passkey already proves it is really you, signing in with a passkey is both faster and stronger than a password plus an authenticator code.

We strongly encourage every team member to add a passkey. They remain optional — your existing password and two-factor authentication continue to work exactly as before.

How passkeys work with two-factor authentication

• When you sign in with a passkey, you are taken straight to your dashboard — you do not need to enter a separate two-factor code, because the passkey already satisfies our multi-factor requirement.
• If you sign in with your password instead, you will still be asked for your two-factor authentication code as usual.

Adding a passkey

1. Log in and open the Two Factor Authentication page from Settings.
2. Scroll to the Passkeys section.
3. Give your passkey a recognisable name, such as "Work laptop" or "Personal phone".
4. Click Add a passkey and follow your device's prompt to confirm with your fingerprint, face, or device PIN.

Your new passkey will appear in the list straight away. You can add a passkey for each device you regularly use.

NOTE

A passkey is tied to the specific Secure Clinic web address (subdomain) of your organisation. A passkey you create for one organisation cannot be used to sign in to a different one — this keeps each organisation's access fully separated.

Signing in with a passkey

On the login page, devices that support passkeys will offer your saved passkey automatically in the email field, or you can click Sign in with a passkey. Choose your account, confirm with your device, and you are signed straight in.

If your browser or device does not support passkeys, simply sign in with your password and two-factor code as normal.

Removing a passkey

If you lose a device or no longer want to use a passkey, open the Passkeys section on the Two Factor Authentication page, find the passkey in the list, and click Remove. That passkey can no longer be used to sign in.

WARNING

Make sure you can still sign in another way (for example, your password and two-factor code, or another passkey) before removing your only passkey.