Security — passkeys & step-up
Adding a passkey and why sensitive actions ask you to confirm.
What a passkey adds
A passkey is your device’s built-in security (Touch ID, Face ID, Windows Hello) registered with your account. Once you have one, sensitive actions require a fresh hardware-backed confirmation — so even a stolen login session can’t refund orders or steal credentials. Sign-in itself stays the email flow; the passkey is the vault door on top.
Registering one
Go to Admin → Security and press Register a passkey — your browser prompts for your fingerprint/face/PIN and stores the key on your device (or in iCloud Keychain / Google Password Manager). Tip: if a password-manager extension intercepts the prompt with its own error, choose “Use a different passkey” and pick your device’s built-in option.
What asks for step-up
With a passkey registered, you’ll be asked to confirm on: refunds, certificate revocation, manual enrollments and grants, payment connect/disconnect, HubSpot connect/disconnect, API key create/revoke, and referral-program changes. No passkey registered? These actions simply proceed — registering is what switches the protection on.
Managing your passkeys
The Security page lists your keys with added/last-used dates. Removing one requires a fresh passkey confirmation itself; removing your last key turns step-up protection off. Register a second passkey (e.g. phone + laptop) so losing a device never locks you out.