Passkeys
For everyonePasskeys
Section titled “Passkeys”A passkey is a cryptographic credential that lives on your device — your phone, laptop, or hardware security key. You unlock it with the same fingerprint, face, or PIN you use for the device itself. Once registered, you sign into Keystone with that gesture instead of typing a password.
Why bother
Section titled “Why bother”Passkeys are immune to phishing — they only release the signed challenge to the real Keystone domain, so a lookalike site can’t trick you into handing over a credential. They’re also faster than typing.
Registering one
Section titled “Registering one”- From the portal, open My passkeys in the left rail.
- Click Register a new passkey. Your browser shows the system passkey prompt.
- Choose where to store it — usually your device (Touch ID / Windows Hello / Android), but a hardware key (YubiKey, Titan) works too.
- Give the passkey a label. “MacBook fingerprint” or “YubiKey on my desk” is more useful than “key 1” when you come to revoke it later.
You can register one passkey per device you actually use. Don’t share a passkey across devices.
Revoking one
Section titled “Revoking one”When you sell your laptop, lose your phone, or stop carrying a security key, revoke its passkey. The list shows the label, when it was registered, and when it was last used. Click Revoke next to the row.
A revoked passkey can no longer be used to sign in, even if someone gets the device. The credential row stays on file for the audit trail — use Remove to delete it entirely.
Gotchas
Section titled “Gotchas”- Revoking your only passkey doesn’t lock you out — you can still sign in via your usual SSO/password. But if passkeys are your only path, register a backup before revoking the primary.
- A passkey signs in one account. If you have a personal and work Keystone account on the same device, you need a separate passkey per account.