Passkeys, enrolment and recovery
Sign in with a passkey that checks it is you, and recover without a password.
In the consolePasskeysYou
Adding a passkey
vaigil auth enrol sam@example.com --for 24hIt prints a one-time link that adds that person's passkey and does nothing else. Give it to them the way you would give a key; --revoke ends it.
User verification
Every passkey must check it is you, with a PIN, a fingerprint or a face, at registration and at every sign-in (NIST SP 800-63B-4). A security key with no PIN is asked to set one.
Failed sign-ins
Failures lock out the places they come from, not the person: from where you usually sign in, or with your passkey, you still can. After many consecutive failures from anywhere, the method is disabled until the person proves themselves another way or an administrator lets it work again.
vaigil auth unlock sam@example.comWhen every administrator's way in is lost
vaigil auth recoverBreak-glass for the operator of the machine, recorded in the audit log.