Passkeys and account security
Protect your account with passkeys and recovery codes, manage your password and signed-in sessions, and review your security activity.
Security & sign-in gathers everything that controls how you get into Ngenaire: passkeys for a second sign-in step, recovery codes, your password, the devices where you are signed in, and a log of every sign-in and security change.
Where: user menu Security & sign-in ยท
/settings/security
Passkeys and two-step verification
A passkey adds a second step to sign-in. After your password or Google, you confirm with something only you hold: Touch ID, Windows Hello, your phone or a hardware security key. It is phishing-resistant and there is nothing to type. The card's badge shows whether two-step verification is On or Off.
Add a passkey
- Click Add a passkey.
- Optionally give it a Name you will recognize, like "MacBook Touch ID" or "My phone".
- If your account has a password, enter it in Confirm your password.
- Click Create passkey and follow the browser prompt. Use this device's built-in sensor, scan the QR code with your phone, or touch a security key.
Your first passkey turns two-step verification on and shows your recovery codes (see below). From then on, every sign-in asks for a passkey after your password or Google.
Each passkey row shows when it was added and when it was last used. Passkeys belong to your Ngenaire address: one created here works only for this Ngenaire site.
Remove a passkey
Click Remove on its row and confirm. Removing your last passkey turns two-step verification off, and your recovery codes stop working with it.
Register at least two passkeys, for example your laptop and your phone, so losing one device never locks you out.
Recovery codes
When you add your first passkey, Ngenaire shows 10 single-use recovery codes, in the form xxxx-xxxx-xx. They are shown once and stored only as hashes, so nobody can show them to you again.
- Click Copy or Download (a text file named
ngenaire-recovery-codes.txt) and keep them somewhere safe, such as a password manager. - Click I've saved them.
At sign-in, choose Use a recovery code instead to use one in place of a passkey. The card shows how many remain, for example 7 of 10 recovery codes left. Click Generate new codes to replace the whole set: confirm your password if you have one, and every old code stops working.
Password
Change your password in the Password card: enter your Current password and a New password of at least 10 characters, then click Update password.
- Changing your password signs out every other device; you stay signed in here. A confirmation shows how many sessions were ended, and Ngenaire emails you that the password changed.
- If you only sign in with Google, the card is titled Set a password. Adding one gives you a second way in.
- Forgot it? Use Forgot password? on the sign-in screen. See Sign in.
Where you're signed in
This card lists every active session: browser and operating system, IP address, when it was last active and when it signed in. Your current one is marked This device.
- Click Sign out on a row to end that session.
- Click Sign out others to end every session except this one.
Sessions end on their own after 7 days without activity or 30 days after sign-in.
Security activity
The Security activity log lists your latest sign-ins and changes to how you sign in, each with its IP address and time. Failed sign-in attempts are highlighted. Entries include:
| Entry | Meaning |
|---|---|
| Signed in / Signed out | A session started or ended |
| Failed sign-in attempt | Someone entered a wrong password for your account |
| Password changed / Password reset | Your password was changed here or through a reset email |
| Two-step verification turned on / turned off | Your first passkey was added, or your last one removed |
| Passkey added / Passkey removed | Your passkeys changed |
| Recovery code used / Recovery codes regenerated | A code signed you in, or you replaced the set |
| Access token created / Access token revoked | A personal access token changed on API & MCP access |
| Session signed out / Other sessions signed out | You ended sessions from this page |
| Google account linked | Google sign-in was connected to your account |
Lockout and rate limits
- 10 failed passwords in a row lock the account for 15 minutes. A successful sign-in or a password reset clears the counter.
- Sign-in, passkey and recovery-code attempts are rate limited per account and per network.
- Error messages never reveal whether an account exists or is locked.
Ngenaire does not use authenticator-app (TOTP) codes or SMS; passkeys are the second factor.
If something looks unfamiliar
- Change your password. This signs out every other device.
- Check Where you're signed in and sign out anything you do not recognize.
- Review your passkeys and remove any you did not add, then generate new recovery codes.
- Open API & MCP access and revoke tokens you do not recognize. Personal access tokens are separate from sessions and keep working until they expire or are revoked.