What a passkey is

A passkey lets you sign in to Airogel Editor with your fingerprint, face, or device PIN instead of typing a password. It is stored by your device or password manager (iCloud Keychain, Google Password Manager, Windows Hello, 1Password and others), and the private part of it never leaves there.

Passkeys work only on app.airogeledit.org, so a look-alike site cannot use yours and a published game can never ask for it. Unlike a password, a passkey can't be phished, reused on another site, or leaked in someone else's data breach.

Add a passkey

On your Projects page, open the ⋮ menu at the top right and choose Security, or go straight to app.airogeledit.org/security.
Under Passkeys, optionally type a name, such as MacBook or iPhone, so you can tell your passkeys apart later. Without one it is named after the day you added it.
Choose Add a passkey and follow your browser's prompt.

The Security page asks you to sign in again if your last sign-in was more than 15 minutes ago. This stops someone who finds your computer unlocked from adding a passkey of their own.

If you don't see Add a passkey, your browser doesn't support passkeys. Current versions of Chrome, Safari, Edge and Firefox all do.

Sign in with it

On the sign-in page, choose Sign in with a passkey, or click the email field and pick your passkey from the suggestions your browser shows. You don't need to type your email address.

Your password keeps working too, unless you require a passkey (below).

Rename or remove a passkey

On the Security page, open a passkey to rename it or choose Remove. Each passkey shows when it was added and last used. Synced means your password manager backs it up and shares it between your devices. Removing a passkey here does not delete it from your device; delete it there too if you no longer want it.

Require a passkey

Under Require a passkey on the Security page, choose Require a passkey to turn off password sign-in for your account. A stolen or reused password then can't get in. You need at least one passkey first.

When you turn it on:

You're shown ten recovery codes. Each signs you in once if you lose your passkeys. Save them somewhere safe, such as your password manager. They're shown only once.
Every other browser signed in to your account is signed out.
MCP clients you've connected (see Connect an MCP client) and API tokens keep working, since you authorized each of them separately.

While the requirement is on:

Signing in with your password is refused, even with the right password.
Resetting your password by email still changes it, but does not turn password sign-in back on.
You can't remove your last passkey. Add another, or turn the requirement off first.
Generate new recovery codes gives you a fresh set of ten. Your old codes stop working.
Allow password sign-in again turns the requirement off. Your recovery codes stop working.

Add a second passkey

A synced passkey, or a second one on another device or security key, means losing one device doesn't lock you out.

If you lose your passkeys

On the sign-in page, choose Use a recovery code. Enter your email address and one of your recovery codes; capitals and the dash don't matter. Each code works once, and the page tells you how many you have left.

Once you're in, add a new passkey on the Security page and remove the one you lost. If you're running low on codes, generate a new set.

If you have no passkeys and no recovery codes left, email support@airogeledit.org from the address on your account. Once support has confirmed the account is yours, they can turn password sign-in back on.