Passkeys

Passkeys provide a secure, passwordless way to sign in to your Ottili ONE account using biometrics (fingerprint, face recognition) or security keys (YubiKey, etc.).

What Are Passkeys?

Passkeys are a modern authentication standard (WebAuthn/FIDO2) that replaces passwords with cryptographic keys stored securely on your device. When you sign in:

1. Your device proves it has the private key (without revealing it)

2. Ottili ONE verifies the proof using the public key

3. You're authenticated without typing a password

Why Use Passkeys?

Security Benefits

• Phishing-resistant*: Passkeys are bound to auth.ottili.one and cannot be used on fake websites
• No password theft*: There's no password to steal, guess, or leak in data breaches
• Stronger than 2FA*: Passkeys provide stronger security than traditional two-factor authentication
• No shared secrets*: Unlike passwords, the private key never leaves your device

Convenience Benefits

• Faster sign-in*: One tap or biometric scan instead of typing passwords
• No password management*: No need to remember, store, or change passwords
• Cross-device sync*: Passkeys sync securely across your devices (Apple, Google, Microsoft accounts)
• Works offline*: Authentication works even without internet (device proves possession locally)

Setting Up Passkeys

Requirements

• Browser*: Chrome 109+, Safari 16+, Firefox 122+, Edge 109+
• Device*: Smartphone, tablet, or computer with biometric sensor or security key
• Account*: Active Ottili ONE account with verified email

Step 1: Navigate to Passkey Settings

1. Sign in to your Ottili ONE account

2. Go to [auth.ottili.one/passkeys](https://auth.ottili.one/passkeys)

3. Click "Add passkey"

Step 2: Create Passkey

1. Your browser will prompt you to create a passkey

2. Choose your authentication method:

- Biometric*: Fingerprint or face recognition

- Device PIN*: Your device's unlock PIN/password

- Security key*: Physical security key (YubiKey, etc.)

3. Follow your device's prompts to complete registration

4. Give your passkey a name (e.g., "iPhone 15 Pro", "MacBook Pro")

5. Click "Save"

Step 3: Test Your Passkey

1. Sign out of your account

2. Go to [auth.ottili.one/login](https://auth.ottili.one/login)

3. Click "Sign in with passkey"

4. Select your passkey when prompted

5. Authenticate using your biometric or security key

6. You're signed in!

Using Passkeys at Login

Method 1: Passkey Button

1. Go to [auth.ottili.one/login](https://auth.ottili.one/login)

2. Click "Sign in with passkey"

3. Select your passkey when prompted

4. Authenticate using your biometric or security key

Method 2: Email + Passkey

1. Go to [auth.ottili.one/login](https://auth.ottili.one/login)

2. Enter your email address

3. Click "Continue with passkey"

4. Authenticate using your biometric or security key

Method 3: Autofill (Conditional UI)

Some browsers support passkey autofill:

1. Click the email field on the login page

2. Your browser shows available passkeys

3. Select your passkey

4. Authenticate using your biometric or security key

Managing Your Passkeys

View Passkeys

Go to [auth.ottili.one/passkeys](https://auth.ottili.one/passkeys) to see all your registered passkeys:

• Name*: The name you gave the passkey
• Created*: When the passkey was registered
• Last used*: When you last signed in with this passkey
• Type*: Platform (device) or Cross-platform (security key)

Rename Passkeys

1. Go to [auth.ottili.one/passkeys](https://auth.ottili.one/passkeys)

2. Click "Edit" next to the passkey

3. Enter a new name

4. Click "Save"

Delete Passkeys

Warning*: Deleting a passkey removes your ability to sign in with it. Make sure you have another passkey or authentication method before deleting.

1. Go to [auth.ottili.one/passkeys](https://auth.ottili.one/passkeys)

2. Click "Delete" next to the passkey

3. Confirm deletion

Passkey Types

Platform Authenticators (Device-bound)

• Examples*: Touch ID, Face ID, Windows Hello, Android biometrics
• Storage*: Stored securely on your device
• Sync*: May sync across devices using the same platform (Apple, Google, Microsoft)
• Use case*: Primary device you use daily

Cross-Platform Authenticators (Roaming)

• Examples*: YubiKey, Google Titan Key, Feitian Key
• Storage*: Stored on the physical security key
• Sync*: No sync; the key is portable
• Use case*: High-security accounts, backup authentication

Troubleshooting

"Passkey not available" Error

Cause*: No passkey registered for your account or browser doesn't support passkeys.

Solution*:

1. Check browser compatibility (see Requirements above)

2. Register a passkey at [auth.ottili.one/passkeys](https://auth.ottili.one/passkeys)

3. Use an alternative sign-in method (password + 2FA)

"Authentication failed" Error

Cause*: Biometric verification failed or security key not recognized.

Solution*:

1. Try again with clean fingers (for fingerprint)

2. Ensure good lighting (for face recognition)

3. Re-insert security key and try again

4. Use a different passkey or authentication method

"Passkey not syncing to new device"

Cause*: Passkey sync depends on your platform's account (Apple ID, Google Account, Microsoft Account).

Solution*:

1. Ensure you're signed in to the same platform account on both devices

2. Check that passkey sync is enabled in your platform settings

3. For cross-platform keys, physically transfer the security key

Browser Compatibility Issues

Chrome/Edge*: Full support since version 109

Safari*: Full support since version 16 (macOS 13, iOS 16)

Firefox*: Full support since version 122

Older browsers*: Use password + 2FA or upgrade your browser

Best Practices

1. Register Multiple Passkeys

Register at least 2 passkeys for redundancy:

• Primary: Your main device (phone or laptop)
• Backup: Security key or secondary device

2. Keep Password as Backup

Don't remove your password entirely. Keep it as a backup method in case:

• You lose access to all your passkeys
• You're using an older browser
• You're on a shared/public computer

3. Name Passkeys Clearly

Use descriptive names to identify passkeys:

• ✅ "iPhone 15 Pro (primary)"
• ✅ "YubiKey 5 NFC (backup)"
• ❌ "Passkey 1"
• ❌ "Device"

4. Test Regularly

Test your passkeys periodically to ensure they work:

1. Sign out

2. Sign in with each passkey

3. Verify authentication succeeds

5. Secure Your Devices

Passkeys are only as secure as your device:

• Use strong device PIN/password
• Enable device encryption
• Keep your device's operating system updated
• Don't share your device unlock credentials

Security Considerations

What Makes Passkeys Secure?

1. Asymmetric cryptography*: Private key never leaves your device

2. Origin binding*: Passkey only works on auth.ottili.one (not phishing sites)

3. User verification*: Requires biometric or PIN to use

4. No shared secrets*: Server never sees your private key

What Could Go Wrong?

1. Device loss*: If you lose your device, you lose platform passkeys

- Mitigation*: Register multiple passkeys, keep password as backup

2. Biometric bypass*: Someone forces your finger/face to unlock

- Mitigation*: Use PIN instead of biometrics in high-risk situations

3. Sync vulnerabilities*: Cloud sync could be compromised

- Mitigation*: Use cross-platform keys for high-security accounts

Passkeys vs. Passwords vs. 2FA

Frequently Asked Questions

Can I use passkeys on multiple devices?

Yes! Passkeys can sync across your devices (Apple, Google, Microsoft accounts) or you can use a portable security key.

What if I lose my device with the passkey?

If you have other passkeys or a password backup, you can still sign in. Then register a new passkey on your replacement device.

Are passkeys supported on mobile?

Yes! Passkeys work on:

• iOS 16+*: iPhone and iPad
• Android 9+*: Android phones and tablets
• Mobile browsers*: Chrome, Safari, Firefox

Can I use passkeys without biometrics?

Yes! You can use:

• Device PIN/password
• Physical security key (YubiKey, etc.)

Do passkeys work offline?

Yes! The authentication happens on your device. You only need internet to send the proof to Ottili ONE.

Can I use passkeys with password managers?

Yes! Many password managers now support passkeys:

• 1Password*: Full passkey support
• Bitwarden*: Full passkey support
• Dashlane*: Full passkey support
• LastPass*: Limited support

Will passkeys replace passwords entirely?

Eventually, yes. But for now, we recommend keeping your password as a backup method.

Related Articles

• [Two-Factor Authentication](/docs/auth-two-factor-authentication) - Traditional 2FA with authenticator apps
• [Active Sessions](/docs/auth-sessions) - Manage your login sessions
• [Recovery Codes](/docs/auth-recovery-codes) - Account recovery when you lose access

Need Help?

If you're having trouble with passkeys:

• Check browser compatibility (see Requirements above)
• Review our [troubleshooting guide](#troubleshooting)
• Visit our [Help Center](https://help.ottili.one)
• Contact support at support@ottili.one