Account security

Passkeys

Add a passkey in Settings to sign in with Face ID, Touch ID, Windows Hello or a security key. Passkeys only work on app.vallkey.com, so a look-alike site cannot use them. Once your account has a passkey, the management token can no longer sign in to the dashboard.

Authenticator app

Anyone on the team can add an authenticator app (Google Authenticator, 1Password, Authy) in Settings. After signing in with an email code, GitHub or the recovery token, Vallkey then asks for a 6-digit code from the app. Passkey sign-in does not need it: a passkey already proves two things at once. Setting it up gives ten one-time recovery codes for a lost phone; turning it off needs a current code.

Confirm it is you

Some actions are dangerous even for someone who is signed in, for example on a laptop left open. Before them, Vallkey asks you to confirm it is you with a passkey, a code from your authenticator app or a code sent to your email. One check covers the next ten minutes, and signing in counts as one.

• Deleting or reviving a key, changing its real key, rotating it, and changing where alerts go
• Inviting people, changing roles, removing people and creating API tokens
• Adding or removing a passkey, setting up an authenticator app, connecting or disconnecting GitHub, and changing your email
• Exporting or deleting the account, changing the plan, and approving a command line sign-in

Killing a key never asks: stopping damage should not wait. API tokens and the management token are not asked either, because they are credentials of their own, scoped and revocable.

Require a passkey

The owner can make passkeys the only way into the dashboard for the whole team. Email codes, GitHub and the recovery token then stop opening the dashboard, and everyone else is signed out once. The recovery token keeps working with the management API, which is how to turn the setting off if every passkey is lost.

Recovery token

The management token you get at sign-up works with the management API and recovers your account if you lose your passkeys. Keep it in a password manager, not in your app.

Replacing the token

If your token may have leaked, replace it in Settings. The old token stops working immediately and every other session is signed out. Ghost keys and API tokens keep working.