Passkeys

A passkey signs you in to webmail with your fingerprint, face or device PIN instead of your password. It is kept by your phone, computer or password manager (iCloud Keychain, Google Password Manager, Windows Hello, 1Password, Bitwarden and others), works only on the site it was made for, so a look-alike phishing site cannot use it, and never leaves your device.

Add a passkey

In webmail, open Settings → Security → Passkeys.
Give it a name you will recognise (the device or password manager), enter your current password, and choose Add a passkey.
Follow your browser's prompt.

You can add up to 10, one per device or password manager. Each works on the webmail address you made it on (shown with it), so a passkey made at mail.example.com does not sign in at another address. You get an email whenever a passkey is added or removed.

On the sign-in page, choose Sign in with a passkey: there is no need to type your address. A passkey sign-in:

counts as two-step sign-in, since it proves both that you have the device and that you unlocked it. If your team requires two-step sign-in, a passkey meets it: right after your first password sign-in you can add a passkey instead of setting up an authenticator app;
is not held for a password change when your password has expired, as it does not use the password;
is refused, like a wrong password, if the passkey looks copied (its counter went backwards), and failures count toward the same sign-in limits.

Mail apps (Outlook, Apple Mail, Thunderbird) still sign in with your password or an app password; passkeys are for webmail.

Rename or remove one

Settings → Security → Passkeys lists them with when each was last used. Removing one needs your current password. If you lose a device, remove its passkey from another one, or ask your administrator.

For administrators

The Passkeys button on a mailbox in the admin panel lists that mailbox's passkeys and removes one for a lost or stolen device; the API is GET and DELETE /v1/tenants/{tenantId}/accounts/{accountId}/passkeys. Removing a passkey does not end the sessions it opened: end those with the mailbox's sessions.

Mailboxes that sign in with a Zappocity account add passkeys there instead, where they cover every Zappocity product.