# Passkeys and two-factor authentication A passkey lets you sign in with your face, fingerprint or a security key, and two-factor authentication adds a second check so a stolen password is not enough. ## What is a passkey? A passkey is a sign-in method built into your phone, laptop or security key. You unlock it with Face ID, Touch ID, your device PIN or the key itself. There is no password to remember or steal. ## Who must use two-factor authentication Administrators, auditors and the owner of a WorkApproved account must set it up before they can see an organisation. A stolen password would otherwise be enough to see everything, or to change who approves your money. Approvers and viewers are not required to, though they can. Either of these counts: - a **passkey** - an **authenticator app** (a free app on your phone that shows a six-digit code) If you are asked to set it up, the setup checklist step is **Secure your account**. ## Add a passkey 1. Open the user menu, choose **Settings**, then **Security**. You may be asked to confirm your password first. 2. Under **Passkeys**, choose **Add passkey**. 3. Give it a name you will recognise, such as "MacBook" or "iPhone". 4. Choose **Register passkey** and follow your device's prompts. You can add more than one. Add a second on another device, so you have a way back in. ## Sign in with a passkey 1. On the sign-in page, choose **Sign in with a passkey**. 2. Follow your device's prompt. If you sign in with your password and a passkey is your second step, you are asked to **Use your passkey** to finish. ## Set up an authenticator app 1. Go to **Settings**, then **Security**, then **Authenticator app**, and choose **Set up the app**. 2. Scan the QR code with your authenticator app, or enter the setup key by hand. 3. Enter the six-digit code the app shows. 4. Store your **recovery codes** somewhere safe, such as a password manager. Each works once, if you lose your phone. Next time you sign in with your password, enter the code from the app. If you have lost your phone, choose **Lost your phone? Use a recovery code**. ## If you lose a passkey Passkeys have no recovery codes. Ask an administrator of your organisation or WorkApproved support to help you back in. To have your own way back, add a second passkey or set up the authenticator app, which has recovery codes. ## Sign in with Xero Under **Sign in with Xero** on the Security page, choose **Link Xero login** to sign in with your Xero login. Xero asks for its own two-step sign-in, so WorkApproved does not ask for another. Before you can **Unlink Xero login**, set a password or add a passkey so you still have a way in. ## Other things on the Security page - **Remove** a passkey you no longer use. - **Sign out of other devices** if you lost a phone or used a computer that is not yours. Your password stays the same. - **Update password**. If you signed in through Xero, you can **Set a password**, which lets you sign in without Xero. ## Related - [Connect Xero](https://workapproved.app/help/connect-xero.md) - [Approve a bill](https://workapproved.app/help/approve-a-bill.md) - [Get help or send a correction](https://workapproved.app/help/get-help-or-send-a-correction.md) Still stuck? Email hello@workapproved.app. This guide is also in the app at https://go.workapproved.app/help/passkeys-and-two-step-sign-in. ## Start your free trial 7 days free. A card is needed to start. From NZ$39 + GST per Xero organisation per month, unlimited users. [Start free trial](https://go.workapproved.app/register). --- Start a free trial: https://go.workapproved.app/register (7-day free trial, card needed) · Sign in: https://go.workapproved.app/login Contact: hello@workapproved.app (support) · security@workapproved.app (security reports) Legal: [Terms](https://workapproved.app/terms.md) · [Privacy](https://workapproved.app/privacy.md) · [Partner terms](https://workapproved.app/partner-terms.md) · [Subprocessors](https://workapproved.app/subprocessors.md) WorkApproved is a product of [Stone Pritchard Limited](https://stonepritchard.com), [NZBN 9429053953216](https://www.nzbn.govt.nz/mynzbn/nzbndetails/9429053953216/), New Zealand. © 2026 Stone Pritchard Limited. Xero is a trademark of Xero Limited. WorkApproved is an independent product and is not endorsed by, or affiliated with, Xero.