Passkeys, two-step sign-in, and losing access

Ways to sign in

You sign in with Google, GitHub, an Ethereum wallet, or a passkey. FullFi asks those providers for no email address or profile. One account can have several of them: link more in Settings → You → Sign-in methods. You can't remove your last one, so you always keep a way in.

Passkeys

A passkey signs you in with your device's fingerprint, face, or PIN, or with a security key. FullFi keeps only its public key and the name you give it, encrypted. The private key never leaves your device or password manager, and it only works on FullFi's own site, so it can't be phished.

Sign in another way first, then select Add a passkey in Settings → You → Sign-in methods. After that, Continue with a passkey on the sign-in page is enough. Passkeys synced by a password manager (iCloud Keychain, Google Password Manager, and others) follow you to your other devices.

Two-step sign-in

With two-step sign-in on, signing in with Google, GitHub, or a wallet is only the first step: FullFi then asks for one of your passkeys. Someone who gets into one of those accounts still can't open your ledger. Signing in with a passkey is already both steps.

Turn it on with Turn on two-step sign-in, in the same place. It needs a passkey first. Devices already signed in stay signed in; sign them out under Settings → You → Sessions if you want them to go through it too.

If you lose a passkey

FullFi has no email address for you, so there's no reset link. No one at FullFi can switch two-step sign-in off for you, or let you in another way. That's deliberate: a recovery shortcut would also be a way in for someone else.

What you can do depends on what you still have:

Another passkey: sign in with it, or use it as the second step, then remove the lost one in Settings.
A synced passkey: it's still in your password manager on your other devices. Use it from there.
Two-step sign-in off: any other sign-in method you linked still works. Once you're in, remove the lost passkey and add a new one.
Only Google, GitHub, or a wallet, with two-step sign-in on: you can't finish signing in, and neither can anyone at FullFi.

So before you turn two-step sign-in on, keep at least two passkeys on different devices, or one synced by a password manager. While you have only one, Settings reminds you. FullFi won't let you remove your last passkey while two-step sign-in is on: add another one or turn it off first.