Passkeys and trusted devices

A passkey lets you sign in with your fingerprint, face, device PIN or a security key instead of a password. With a passkey that supports the PRF extension, the same step can also unlock your workspace keys; that unlock key is worked out in your browser and isn't sent to us.

#Add or remove a passkey

1. Open Security settings. Open My Account in the sidebar, which opens on Security.
2. Locate Trusted Devices. Find the Trusted Devices card.
3. Add a passkey. Click Add passkey and follow your browser or device prompt.
4. Remove a passkey when needed. To remove one, click Remove next to it and confirm so that device can no longer sign in with that passkey.

Each passkey shows the kind of device and the date you added it.

#Sign in with a passkey

Choose Sign in with Passkey on the sign-in page. If your passkey supports PRF, your keys unlock in the same step. If it doesn't, you're still signed in, and your keys come from this browser's saved copy or from device approval instead.

#This browser

The This browser card controls how a browser you've already used remembers you:

• Keep me signed in on this browser: on by default. The browser keeps an encrypted copy of your keys, protected by your operating system account, so you unlock without extra steps. Turn it off to need approval, your password or a passkey each time you open InviziPoll here.
• Require passkey to unlock on this browser: every unlock needs your passkey. Use it on shared or high-risk machines.
• Export encrypted backup (.json): a shortcut to the recovery file on Backup & Recovery.

#Other cards on this page

• Vault idle lockout: locks your keys after a set number of minutes without activity, 30 by default. Activity in any open InviziPoll tab counts, including moving the mouse or scrolling, so a tab you forgot in the background won't lock you out of the one you're using. If your computer sleeps past the limit, you're locked when you come back. An owner can set a workspace-wide maximum in Workspace Settings, and if it's shorter than your setting, the workspace maximum applies.
• Browsers that skip inbox verification: browsers you chose to trust for 30 days after verifying your email on a new device. Remove any you don't recognize.
• Two-Factor Authentication: an authenticator-app code at sign-in. The team-wide policy is under Admin → 2FA.

#A passkey as your way back in

A passkey saved to iCloud Keychain or Google Password Manager syncs to your other devices. On any of them it signs you in and opens your key backup, with no password to remember. That makes it the easiest way back in if you lose a device.

You can add one here, or from the Add a passkey card under Settings → Backup & Recovery. That card shows when your browser can make a passkey and you don't have a synced one opening your backup yet.

Some passkeys, like Windows Hello, can sign you in but can't open your key backup. Keep your recovery key or recovery kit as well. See Recovery, emergency kit, and device handoff.

#SSO and passkeys

SSO confirms who you are, but it doesn't unlock your keys. After an SSO sign-in, InviziPoll uses this browser's saved copy or a PRF passkey if it can, and otherwise sends you to device approval.

If your account signs in without a password, through SSO or a passkey only, you're asked to save a recovery key before you can use the admin console. It's what unlocks your key backup on a new device. See Recovery, emergency kit, and device handoff. See Single sign-on (SAML & OIDC).

#Related

• Recovery, emergency kit, and device handoff
• Single sign-on (SAML & OIDC)