Passkeys & Account Recovery

Every person signs in with their email address and password. A passkey is an optional second lock you can add on top of that. This page explains what a passkey is, how to add your first one, what changes at sign-in once you have one, and how recovery codes get you back in if the device holding your passkey is lost.

What a passkey is

A passkey is a sign-in credential that lives on something you own — your phone, your laptop, or a hardware security key — and is unlocked with the same fingerprint, face or device PIN you already use. There is nothing to type and nothing to remember. Because the passkey only ever answers to Shop Commander's own sign-in page, a look-alike site can't collect it the way it can collect a password, and a password that leaks somewhere else is not enough on its own to open your account.

Most phones and computers store passkeys in the built-in password manager (for example iCloud Keychain or Google Password Manager) and sync them between your devices. A hardware security key keeps the passkey on the key itself.

Passkeys are optional

Nobody is required to add a passkey. The rule is simple:

• An account without a passkey signs in with its email and password, exactly as before.
• Once an account has a passkey, every sign-in asks for it after the password, and so do the shop's most sensitive changes — transferring ownership of the shop, exporting the full shop archive, issuing integration secrets and creating phone-system credentials. Without a passkey those changes run on your signed-in session alone.
• Removing your last passkey takes the account back to password-only sign-in.

Any active staff member with a password can add one. Passkeys are per person, not per shop: if you work at more than one shop, the same passkey covers all of them.

Adding your first passkey

Open My Profile and choose Manage shop passkeys. The Your shop passkeys page explains that no passkey is set up yet; choose Add a passkey.

On the Add a shop passkey page, enter your Password and give the key a Passkey label — something that tells you which device it lives on, like "Work phone" or "Front desk laptop". No approval file is needed for a first passkey. Choose Register passkey, and your browser or phone takes over: it asks you to confirm with your fingerprint, face, PIN or security key, and stores the new passkey.

When it finishes you'll see "Passkey registered. Previous sessions have been revoked. Sign in with your password and passkey." Adding a key signs out every session on every device, including the one you just used, so choose Sign in and sign in again with your password and the new passkey.

Cancel and clear abandons the form without changing anything.

Signing in with a passkey

Sign in as usual with your email and password. If your account has a passkey, the page then prompts for it — unlock with your fingerprint, face, PIN or security key and you're in. If your account is a member of more than one shop, the shop picker follows as it always has.

A passkey never replaces the password; you always present both.

Keep a backup passkey

A single passkey on a single phone is a single point of failure. Once you have one, go back to Manage shop passkeys and choose Add a passkey again; the page is now headed Add a backup passkey. Leave the Private approval file empty, enter your password and a label, and choose Register passkey — you'll be asked to verify an existing passkey first, then to register the new one. Like a first key, adding a backup signs out every session.

A good pattern is one passkey on your phone and a second on a hardware key or a different device that stays at the shop.

The passkey list shows each key's label, when it was Created and when it was Last used ("Not used yet" until it is), so you can see which keys are actually in use.

Recovery codes

Recovery codes are the safety net for the day every device that holds your passkey is lost, stolen or wiped. They are only for an account that has a passkey; a password-only account recovers with the ordinary forgot-password link.

From Your shop passkeys, choose Manage recovery codes. On the Shop recovery codes page, tick I understand older codes and sessions will be invalidated and choose Verify and generate codes. You'll be asked to verify a passkey, and then the page shows a batch of ten codes. Then:

• Save them now, somewhere secure and offline — a password manager entry, a printed sheet in the safe. They are shown only once and cannot be retrieved later.
• Each code works once. Using a code to start a recovery consumes it even if you later cancel.
• Codes expire after one year, and adding or removing a passkey, or generating a new batch, invalidates every code from the old batch — so after any of those, generate and save a fresh set.
• Never send codes to an administrator or to support. Nobody legitimate will ask for them.

Generating codes signs out every session, including this one. Once the codes are saved, tick I have saved my codes securely and choose Clear codes and sign in. If you need another batch within a minute of the last one, the page asks you to wait.

Recovering a lost passkey

If you can still sign in with any passkey, don't recover — just add a new key and remove the lost one as described below. Recovery is for when no passkey you hold works any more.

Recovery is deliberately a heavyweight path, because it ends with every old passkey retired. It needs three things: your password, one unused recovery code, and independent approval from two Shop Commander platform superadministrators. Possessing a code never opens the account on its own.

1. From the sign-in page choose Recover lost passkeys (you must be signed out). On the Recover shop access page enter your Email, Password, one Recovery code and a short Reason for the request, tick I understand this consumes my code and signs out all sessions, and choose Start recovery. This uses up the code and signs out every session; it does not yet replace any passkey or let anyone in. Only a few requests can be started per day.
2. The page now shows a Request ID and a User ID. Contact Shop Commander support and ask for two platform superadministrators to verify who you are and review the request. Share only those two IDs — never your password, your recovery code, or the private record. The request expires after 24 hours.
3. Save the private recovery record. The page shows it in a text box; copy it into a .json file in a secure place. It is not stored anywhere automatically, and it is the only way to resume this request if you leave the page — on return, use Resume from private recovery record to load it.
4. Once both approvals are in, tick I confirm this exact request for replacement or cancellation, enter your Password and a New passkey label, and choose Check approvals and replace passkeys. Your device registers the new passkey; every old passkey is retired and every session is signed out. The page reports "Passkey replaced. Previous keys and sessions are revoked. Sign in with your password and new passkey." — then sign in again from the login page.

Changed your mind, or found the old device? Tick the confirmation and choose Cancel this recovery request. The code you used is still spent, but your existing passkeys stay exactly as they were.

After a successful recovery, generate a fresh batch of recovery codes: the old batch no longer works.

Removing a passkey

On Your shop passkeys, choose Remove beside the key, then Verify and remove in the confirmation. You'll verify one of your passkeys first (the one being removed, or another). Removing a key:

• signs out every session on every device, including the one you're using — you sign in again with your password and a remaining passkey;
• closes any session that was opened with that particular key, even if it was the last one you had;
• invalidates the current batch of recovery codes.

If the key you remove is your last one, the confirmation says so: "This account will then sign in with its password alone." That is allowed — it's how you opt back out of passkeys entirely — but a lost device is a better reason to replace a key than to go without one.

Things to know

• During a support session (when a Shop Commander operator is signed in as you to help), passkeys and recovery codes can't be managed. Finish the support session first.
• Before you change phones, add a passkey on the new device (or make sure your platform password manager has synced it) and keep your recovery codes to hand. Confirm the new passkey signs you in before wiping the old phone.
• Enrollment without signing in. The sign-in page also offers Enroll an approved passkey. That path is for the rare case where you cannot sign in at all and a Shop Commander support operator has issued you a short-lived private approval file; it is not needed for ordinary first-time or backup enrollment. Never share or upload such a file anywhere except that page.
• A passkey is yours, not the shop's. A shop administrator can deactivate your account or change your role, but cannot see, add or remove your passkeys.