The project starts with a small notes repository. Your passkey becomes its only promoter, and approving the first commit makes it the repository's root of trust.
Play the story It walks through every step and stops where your passkey is needed.
The verifier reads only the repository. It gives the same answer here, on a fresh clone, on GitHub, or on your laptop.
Delete this project
An operator created this link for you. It works once.
Store these somewhere safe. Each works once, and they will not be shown again.
Replace them now
Held by is the password manager or security key that stores the passkey, when it can be identified. Synced means that manager can copy the passkey to your other devices. Revoking a passkey stops it signing in, though sessions it already started stay open, and you can't revoke your only one.
Each of your passkeys is held on one device and can't be copied to another. If you lose that device, only a recovery code gets you back in. Add a passkey on another device or a security key, and keep your recovery codes somewhere safe.
Recovery codes let you add a new passkey if you lose all of yours, and each one works once. Replacing them gives you a fresh set of 8, shown only once, and every old code stops working straight away, including copies kept elsewhere or split into shares.
A session keeps one browser signed in for 7 days. Log out ends this one, and Log out everywhere ends all of them, this one included. Log out everywhere else keeps this one and asks for your passkey first, so someone holding a stolen session can't shut you out.
Record id: Copy ⓘ
Your record id names your identity record and never changes, even if every passkey and code does. It isn't secret. To make yourself an operator on your own deployment, add it to the OPERATOR_RECORD_IDS secret.