Passkeys

A passkey lives in one of two places, and the account accepts both.

The platform does not require one kind or the other. It does require two things of any passkey: it must be a discoverable credential, so you can sign in without typing a name first, and it must check that you are present with a fingerprint, face, PIN or device lock. A key that cannot do that cannot be registered or used here.

Which kind your browser offers depends on your browser and device. If the browser cannot create passkeys at all, the page says This browser cannot create passkeys.

1. Remove passkey, on the row of the passkey it removes. Rename is beside it.
2. Add a passkey, with an optional Name for this passkey field before it.

If you dismiss the prompt, the page says No passkey was added. and nothing changes. A security email saying a passkey was added goes to your verified addresses. See Notifications.

Adding a passkey is a sensitive change, so it asks for a recent second factor first. See The Security overview. If your account signs in with a password only, it can add its first passkey after confirming the password, from a browser the account has known for 24 hours, and only once the password itself is that old: a password chosen at registration or at a Choose a password step does not count for the first day. A browser becomes known only through a sign-in that proved more than the password (a passkey, an authenticator code, or a link or code emailed to you); a password alone never does, so sign in once with an emailed link or code and come back after a day. A sign-in finished with an emailed code in place of a lost passkey gets no such allowance: it needs a confirmed second factor first.

Select Rename on a row, type the new name in New name, and select Save name. The page says Passkey renamed. A name only helps you tell passkeys apart. It does not affect how the passkey works.

The device you are using stays signed in. Every other session ends, and a security email goes to your verified addresses. If your browser supports it, the page also tells your password manager which passkeys the account still accepts, so it can stop offering the removed one. That hint is best effort and nothing depends on it.

You cannot remove your last way in#

The platform refuses to leave you with no way to sign in. If the passkey is your only sign-in method, the page says That is your only way to sign in, so it cannot be removed. Add another first. Another passkey or a password counts. A linked account does not. Add a second passkey or set a password, then remove the one you wanted to.

Losing the only device that holds your passkey can lock you out. Register a second passkey on another device or a security key, and keep recovery codes. The Security checkup counts both as a way back in.

An account can hold at most 20 active passkeys by default (an operator can set any limit from 1 to 100). The limit applies to every way of adding one: the Passkeys tab, the passkey prompt at sign-in, registration and recovery. At the limit the page says This account already has the most passkeys it can hold. and suggests removing a passkey you no longer use, then adding the new one. Removed passkeys do not count. Merging two accounts moves the other account passkeys across without this check, so a merged account can hold more for a while.

An account that an organization manages (a managed identity) cannot add, change or remove its own sign-in methods here: those requests are refused, because the organization's directory connection is its only way in.

• Signing in, for what the sign-in page asks when you use a passkey
• Password
• Sessions and devices