Passkeys

A passkey signs you in with your fingerprint, your face, your device PIN, or a hardware security key. It replaces both the password and the two-factor code in a single prompt.

That is not a shortcut. A passkey is a keypair: the private half is created inside your device's secure hardware and never leaves it, and Cosmoner only ever stores the public half. There is nothing in our database that could sign in as you, and nothing for a fake login page to capture — your browser will not offer a Cosmoner passkey to any site that is not Cosmoner, no matter how convincing it looks.

It also already counts as two factors: something you have (the device) and something you are (the fingerprint or face). That is why a passkey is accepted as a complete sign-in rather than as a step after your password.

Add one

Go to Account → Security → Passkeys and choose Add a passkey.

1. Name it — "MacBook Pro", "Work phone", "YubiKey". Only you see this; it is stored with your account, not on the device, and you can rename it later.
2. Confirm on your device. Your browser or operating system takes over and asks for your fingerprint, your face, or your PIN.

That is the whole setup. There is no code to enter and nothing to save.

You can register as many as you like, and you should register at least two — see Not losing access below.

What you can use

• Built-in biometrics — Touch ID and Face ID on Apple devices, Windows Hello, Android's fingerprint or face unlock.
• A password manager — 1Password, Bitwarden, iCloud Keychain, Google Password Manager. These sync the passkey across your devices.
• A hardware security key — a YubiKey or similar, over USB, NFC, or Bluetooth.

Both kinds are offered when you add one, so you are not locked into a single sort of device.

Signing in

On the login page, choose Sign in with a passkey. Your device prompts you, and you are in.

Often you will not need the button at all: tap the email field and any passkey registered for Cosmoner appears in the autofill list, the same way a saved password does. Picking it signs you in directly.

Passkeys work in the internal admin console too, for accounts that have access to it — the passkey belongs to your account, not to one app.

Not losing access

This is the part worth reading twice.

A synced passkey follows you. If it lives in iCloud Keychain, Google Password Manager, or a password manager like 1Password, it is available on your other devices automatically, and a broken laptop costs you nothing.

A device-bound passkey does not. Windows Hello passkeys and hardware security keys stay on the thing that created them. If that is your only passkey and the device is lost, that route into your account is gone with it.

So: register a second passkey — a phone, or a security key you keep somewhere safe. The security page shows a warning when your only passkey is one that cannot sync.

Your password and, if you use it, two-factor authentication keep working throughout. Adding a passkey does not disable either, and they remain a way back in.

Managing them

Account → Security → Passkeys lists every passkey on the account, when it was added, and whether it is backed up to a cloud keychain.

• Rename changes the label only; the passkey itself is untouched.
• Remove stops that device signing in. You can register it again whenever you like.

Removing a passkey is the right move whenever a device is lost, sold, or out of your hands. Unlike a password, there is no need to change anything else — the other passkeys on the account are unaffected, because each one is its own independent key.

Browser support

Passkeys need a reasonably current Safari, Chrome, Edge, or Firefox and a device with a fingerprint reader, a camera, or a PIN. Where they are not supported, the security page says so, and password sign-in is unchanged.