Passkey, handled by a supported device.
Register and manage Passkeys on the Security page. At sign-in, your device verifies with a fingerprint, face, or hardware security key, so you do not have to enter your account password every time.
One less password entry. Sign in with your device.
Register a Passkey to sign in with biometrics or a hardware security key on supported devices. If you prefer passwords, you can also add TOTP two-factor verification.
Learn about sign-in methodsSign-in methods, chosen by you.
Prefer passwords? Add an authenticator too.
Set an account password and optionally link a TOTP-capable authenticator. The authenticator generates one-time codes, adding another verification step to password sign-in.
Sign-in settings require verification before changes.
Before you set up or change a password, Passkey, or TOTP, you re-verify your identity using an authentication method already configured on the account. Even inside the console, you must complete this verification before changing your sign-in method.
When you enable TOTP, link your account to an authenticator, then submit a code it generates to complete verification. After that, the authenticator continues to provide the second factor required for sign-in.
Sign out of the current browser when you are done.
The Security page shows the expiry time of this browser session and the authentication method used for it. On a shared device, sign out of the current browser account when you are finished.
Account sign-in and network terminal configuration are managed separately. Signing out of the console does not disable imported device tunnels; to revoke a device's connection access, revoke the corresponding terminal configuration.
Learn about revoking terminal configurations →Frequently asked questions.
Does Passkey sign-in always require a fingerprint?
No. The specific verification method is provided by your supported device and browser, and you can use biometrics or a hardware security key. Both registration and sign-in require a compatible device environment.
Can a TOTP code replace an account password on its own?
Here, TOTP acts as the second factor for password sign-in. Bind an authenticator on the Security page and complete code verification first, then use it in the corresponding sign-in flow; it is not a standalone sign-in method.
Will signing out of my account sign me out of all devices or revoke tunnels?
This signs you out of the current browser session only, not all device sessions. Terminal tunnels have their own configuration identity; deactivating it requires separately revoking the corresponding configuration.