Second sign-in step

Console sign-in starts with a 6-digit code sent to the member’s email. Members can add a second sign-in step after it: a passkey, an authenticator app, or both. A workspace’s policy decides who must have one. Viewers are not affected: they keep signing in with an emailed code.

Methods

Each person manages their own methods on Sign-in and security (from the account menu, or their member page).

• Passkeys (Face ID, Touch ID, Windows Hello, a password manager or a security key). Add, rename or remove. A passkey also signs you in on its own, with no email: see Sign in with a passkey.
• Authenticator app: scan the code shown under Set up, then enter the app’s current code to confirm. Each code works once.
• Recovery codes: 10 single-use codes, made with your first method and shown once. Keep them somewhere safe. Make new codes replaces them all.

A passkey belongs to the console’s hostname. If your workspace moves to another console address, sign in with the email code and your app or recovery codes, and add the passkey again.

Sign in with a passkey

Once you have added a passkey, the sign-in page needs no email:

• Click the Email field: your browser offers your Houseguest™ passkey among its suggestions. Pick it.
• Or click Sign in with a passkey.

Your device confirms it is you (face, fingerprint or PIN), and you are signed in. This counts as both steps, so it meets a workspace policy that requires a second step, here and in every workspace you switch to. You land in your preferred workspace (Sign-in and security), or the one you used last, the same as with the email code.

A passkey kept on some security keys can only be the second step; Sign-in and security marks it “second step only”. Passkeys in iCloud Keychain, Google Password Manager, Windows Hello and password managers all sign in on their own. After too many failed attempts from one network, passkey sign-in pauses for an hour; the email code still works unless that network also used up its code requests.

Signing in with a second step

1. Enter your email and the emailed code.
2. Use a passkey, enter your authenticator app’s code, or enter a recovery code. Five wrong answers end the attempt.

The workspace policy

Settings › Security › Second sign-in method (needs Change security settings):

Option	Who must have a method
Optional	Nobody. Anyone may add one
Required for Owners and Admins	Anyone who is Owner or Admin at any scope, including share-group and preview admins. The default on the hosted service
Required for everyone	Every member

Each option shows how many people it covers and how many are set up. A change applies at once: people it covers who have no method are sent to Sign-in and security on their next page, and can do nothing else until they add one. While the policy covers someone, they cannot remove their last method.

Lost access

• Lost a passkey or phone: sign in with the email code and a recovery code, then add a new method.
• No recovery codes left: an Owner or Admin can use Reset sign-in methods on the member’s page. It removes their passkeys, app and recovery codes and signs them out; they set up a new method at their next sign-in. Nobody resets themselves, and only an Owner resets an Owner.
• The only Owner is locked out, or the person also belongs to another workspace: contact Houseguest, who reset it after confirming who you are.

Several workspaces

Your methods belong to you, not to a workspace: one passkey, app and set of recovery codes work in every workspace you belong to. Each workspace’s policy applies to your role there, so switching into a workspace that requires a second step asks for it if this session has not used one yet. See Several workspaces.