What are passkeys?
Passkeys let you log in and authorise actions in Moss using your fingerprint, face recognition, or device PIN - instead of SMS codes or the Moss mobile app. They use the security features already built into your device, so there's nothing extra to install.
Passkeys cannot be phished, reused, or guessed. Your biometric data stays on your device and is never shared with Moss.
How do passkeys work?
When you use a passkey, you verify your identity using the security features built into your device:
Method | Where it works |
Fingerprint (Touch ID) | Mac with Touch ID, supported Windows laptops |
Face recognition (Face ID) | iPhone, iPad (when using cross-device QR code) |
Device PIN or password | Windows Hello PIN, macOS password, phone screen lock |
USB security key (e.g. YubiKey) | Any computer with a USB port |
Your biometric data never leaves your device — Moss only receives a cryptographic confirmation that you verified successfully.
Why use passkeys?
Faster - authorise actions instantly on your computer, no need to pick up your phone
More reliable - no more waiting for SMS codes or dealing with delivery failures
More secure - passkeys are phishing-resistant and tied to your device
Works everywhere - synced passkeys (via iCloud Keychain, Google Password Manager, or 1Password) work across your devices automatically
Requirements
Supported devices and browsers:
Platform | Browser | Authentication method |
macOS (Ventura+) | Safari, Chrome, Edge | Touch ID or device passcode |
Windows 10+ | Chrome, Edge | Windows Hello (fingerprint, face, or PIN) |
Note: Passkeys on Moss are currently available on web only.
How to set up a passkey
Go to 'Settings' → 'Login & security'
Click 'Set up passkey'
Verify your identity (this is a one-time security step using SMS + email or the Moss mobile app)
Your browser will ask you to create a passkey - confirm with your fingerprint, face, or PIN
Give your passkey a name (e.g. "Work MacBook", "Office PC")
You can register up to 3 passkeys on different devices. We recommend setting up at least two - for example, your work laptop and a personal device - so you always have a backup.
Important: Only set up passkeys on devices you personally own and control.
Where are passkeys stored?
Passkeys can be stored in three ways:
Synced - saved in a password manager like iCloud Keychain, Google Password Manager, or 1Password. These work automatically on any device where you're signed into that manager.
Device-only - stored directly on a single device (e.g. via Windows Hello). These stay on that device only, but you can still use them on another device by scanning a QR code.
External USB key - stored on a hardware security key (e.g. YubiKey). Plug it into your computer's USB port and tap it when prompted. USB keys work on any computer without needing a password manager or syncing. They're especially useful as a backup option.
How to log in with a passkey
Go to the Moss login page
Select 'Log in with passkey'
Confirm with your fingerprint, face, or PIN
That's it - no SMS code or mobile app needed.
How to authorise actions with a passkey
When Moss requires verification for sensitive actions (e.g. approving a payment, granting admin access):
Select 'Authorise with passkey' when prompted
Confirm with your fingerprint, face, or PIN
Done - the action is confirmed immediately on your screen
Managing your passkeys
Go to 'Settings' → 'Login & security' to view and manage your passkeys. For each passkey you can see:
Name
Date created
Last used
You can rename a passkey (e.g. after changing laptops) or remove a passkey you no longer use. Removing a passkey requires verification for security.
Tip: Removing a passkey from Moss does not delete it from your password manager or device. You may want to remove it from both places.
Preferred 2FA method
When you activate passkeys, they automatically become your preferred method for approving sensitive actions. If you later activate the Moss mobile app, the mobile app will become your preferred method instead.
You can always change your preferred 2FA method in Profile > Security > Preferred 2FA method. Choose between:
Passkeys - approve with fingerprint, face, or PIN on your computer
Moss app - approve on your phone
What about other sign-in methods?
Method | Status |
Moss mobile app | Continues to work as before. If you have both passkeys and the mobile app, Moss will use your preferred method. |
SMS OTP | Being phased out. We recommend switching to passkeys or the Moss mobile app. |
TOTP (Google Authenticator) | Being phased out for new users. Existing users will be migrated over time. |
What if I lose my device?
If you have another passkey registered - log in with your backup passkey on another device
If you have the Moss mobile app - log in using mobile app authorisation
If you have synced passkeys (iCloud Keychain, Google Password Manager, 1Password) - your passkey is available on any device where you're signed into that manager
If you can't access any method - contact your Moss admin or our support team to help restore access
Troubleshooting
Issue | What to do |
Passkey not showing during login | Make sure your browser and OS meet the requirements above. Try updating your browser. |
Setup fails | Check that screen lock (PIN, fingerprint, or face) is enabled on your device. Passkeys require a device lock to be active. |
Wrong passkey is offered by browser | If you recently deleted a passkey and added a new one, your browser may cache the old credential. Cancel the first prompt - your browser should then show your other available passkeys. |
Browser extension conflict | Some browser extensions may interfere with passkey prompts. Try disabling extensions temporarily. |
Bluetooth error on cross-device auth | If using a phone to authenticate on another device via QR code, make sure Bluetooth is enabled on both devices. |
1-Password troubleshooting
Some users experience problems when trying to save or use passkeys with 1Password, because multiple passkey providers on the device compete for precedence. This is a known issue for 1Password and unfortunately not something Moss can control.
If 1Password interferes with your passkey setup, you may need to check if your 1Password browser extension is properly configured
On macOS: if passkey saving fails, try going to 'System Settings' → 'General' → 'AutoFill & Passwords' and adjusting which provider handles passkeys
FAQ
How many passkeys can I have?
Up to 3 passkeys per Moss account.
Is my fingerprint or face data sent to Moss?
No. Your biometric data stays on your device and is never transmitted to Moss. We only receive a cryptographic confirmation that you verified successfully.
Can I use passkeys and the mobile app at the same time?
Yes. You can have both set up. Moss will use your preferred method.
Does my organisation need to enable passkeys?
No. Passkeys are available to all users. No admin action is required.