Account and security
Passkeys and account recovery
Passkey protection lets a password account use a device-backed credential and a set of single-use recovery codes while enforcing safeguards against locking the user out.
- Availability
- Accounts whose configured sign-in methods support Stand passkeys
- Configured in
- Dashboard → Profile → Security & sign-in; recovery-code option on the email-first login flow
- Category
- Account and security
- Reference status
- Current
Before you begin
Plan availability: Accounts whose configured sign-in methods support Stand passkeys.
Prerequisite: A recent sign-in, a browser and device that support passkeys, and a usable fallback method for destructive method changes.
Key boundary: Recovery codes are displayed once and are not emailed. Losing every passkey and unused recovery code can require account support or another linked method.
Enable passkey protection
- Start passkey registration from Security & sign-in.
- Complete the browser or device credential ceremony.
- Enable passkey protection after Stand verifies a real registered credential.
- Stand issues a fresh batch of high-entropy recovery codes once.
- Save those codes outside the signed-in device and confirm that they have been stored.
Recovery-code behavior
- Each code can be used once through the recovery option on sign-in.
- Codes are stored in protected form rather than recoverable plaintext.
- Regenerating codes invalidates the entire previous batch and displays the replacements once.
- Using a recovery code triggers an account notification without including the secret code itself.
- Recovery codes are the fallback within passkey-protected sign-in, not an additional factor required after a passkey.
Manage sign-in methods
| Change | Guardrail |
|---|---|
| Add or remove a passkey | Requires recent authentication; removing the last usable credential is blocked when it would cause lockout. |
| Return to password sign-in | Disables passkey-protected mode, invalidates recovery codes, and removes passkey credentials through the account workflow. |
| Connect or disconnect Google or enabled Microsoft | Use the explicit account flow. Disconnection is allowed only when another usable method remains; Microsoft supports work/school accounts only. |
| Remove password | Requires a linked provider and confirmation; passkeys and recovery codes are also removed as part of provider-only conversion. |
| Change email | The old email remains active until the new address is confirmed. |
Recent sign-in requirement
Adding, removing, or converting authentication methods is more sensitive than editing a profile. When the existing login is too old, Stand asks the user to sign in again. The user returns to Profile and may need to retry the change.
Recovery boundaries
- A recovery code cannot be viewed again after its one-time display.
- Regeneration is destructive to unused old codes.
- Passkey availability depends on browser, device, and platform credential support.
- Account recovery restores sign-in; it does not restore a deleted account or organization.