Passkeys and two-factor authentication
A passkey lets you sign in with your face, fingerprint or a security key, and two-factor authentication adds a second check so a stolen password is not enough.
What is a passkey?
A passkey is a sign-in method built into your phone, laptop or security key. You unlock it with Face ID, Touch ID, your device PIN or the key itself. There is no password to remember or steal.
Who must use two-factor authentication
Administrators, auditors and the owner of a WorkApproved account must set it up before they can see an organisation. A stolen password would otherwise be enough to see everything, or to change who approves your money. Approvers and viewers are not required to, though they can.
Either of these counts:
- a passkey
- an authenticator app (a free app on your phone that shows a six-digit code)
If you are asked to set it up, the setup checklist step is Secure your account.
Add a passkey
- Open the user menu, choose Settings, then Security. You may be asked to confirm your password first.
- Under Passkeys, choose Add passkey.
- Give it a name you will recognise, such as "MacBook" or "iPhone".
- Choose Register passkey and follow your device's prompts.
You can add more than one. Add a second on another device, so you have a way back in.
Sign in with a passkey
- On the sign-in page, choose Sign in with a passkey.
- Follow your device's prompt.
If you sign in with your password and a passkey is your second step, you are asked to Use your passkey to finish.
Set up an authenticator app
- Go to Settings, then Security, then Authenticator app, and choose Set up the app.
- Scan the QR code with your authenticator app, or enter the setup key by hand.
- Enter the six-digit code the app shows.
- Store your recovery codes somewhere safe, such as a password manager. Each works once, if you lose your phone.
Next time you sign in with your password, enter the code from the app. If you have lost your phone, choose Lost your phone? Use a recovery code.
If you lose a passkey
Passkeys have no recovery codes. Ask an administrator of your organisation or WorkApproved support to help you back in. To have your own way back, add a second passkey or set up the authenticator app, which has recovery codes.
Sign in with Xero
Under Sign in with Xero on the Security page, choose Link Xero login to sign in with your Xero login. Xero asks for its own two-step sign-in, so WorkApproved does not ask for another. Before you can Unlink Xero login, set a password or add a passkey so you still have a way in.
Other things on the Security page
- Remove a passkey you no longer use.
- Sign out of other devices if you lost a phone or used a computer that is not yours. Your password stays the same.
- Update password. If you signed in through Xero, you can Set a password, which lets you sign in without Xero.
Related
Still stuck? Email [email protected]. This guide is also in the app at go.workapproved.app/help/passkeys-and-two-step-sign-in.