> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shopi.lk/llms.txt
> Use this file to discover all available pages before exploring further.

# Passkeys

> Sign in and protect sensitive account actions using Face ID, fingerprint, Windows Hello, or an external security device — no passwords required.

# 🔑 Passkeys

Shopi supports **Passkeys**, a faster and more secure way for sellers to sign in and authorize sensitive account changes — without typing a password.

Instead of a password, a passkey uses the biometric or security method already built into your device:

<CardGroup cols={2}>
  <Card title="Face ID" icon="face-viewfinder">
    Authenticate instantly on supported iPhones, iPads, and Macs.
  </Card>

  <Card title="Fingerprint" icon="fingerprint">
    Use Touch ID or Android fingerprint sensors to verify it's you.
  </Card>

  <Card title="Windows Hello" icon="windows">
    Sign in on Windows devices with face recognition, fingerprint, or PIN.
  </Card>

  <Card title="External Device" icon="usb">
    Use a hardware security key or a paired phone as your passkey.
  </Card>
</CardGroup>

<Tip>
  You're not limited to one. You can register a passkey on every device you use to manage your Shopi store — your laptop, your phone, and a hardware key can all work independently.
</Tip>

***

## 🧠 Why Passkeys

Passwords can be guessed, reused, leaked in breaches, or phished. Passkeys remove that risk entirely.

<Columns cols={2}>
  <Card title="Nothing to steal" icon="shield-check">
    Passkeys are backed by cryptographic key pairs. There's no shared secret sitting in a database for an attacker to leak.
  </Card>

  <Card title="Phishing resistant" icon="user-lock">
    A passkey only works on the legitimate Shopi domain it was created for, so fake login pages can't capture it.
  </Card>

  <Card title="Faster sign-in" icon="bolt">
    One glance or one touch, and you're in. No more remembering or resetting passwords.
  </Card>

  <Card title="Synced across devices" icon="rotate">
    Your device or password manager keeps passkeys backed up, so switching phones doesn't lock you out.
  </Card>
</Columns>

***

## ⚙️ How Passkeys Work on Shopi

<Steps>
  <Step title="Go to Account Security">
    Open your **Seller Dashboard → Settings → Shop Information**.
  </Step>

  <Step title="Select 'Add a Passkey'">
    Go all the way down, you will find a section as Personal Information and \*\* Add Passkey\*\* Press it, Shopi will prompt your device to create a new passkey.
  </Step>

  <Step title="Confirm with your biometric or device">
    Use Face ID, fingerprint, Windows Hello, or tap your external security device when prompted.
  </Step>

  <Step title="Done">
    Your passkey is now linked to your Shopi seller account and ready to use for sign-in and sensitive actions. When Signin you can simply press, Signin with Passkey and logged in. No more entering email / passwords.
  </Step>
</Steps>

<Check>
  You can register more than one passkey. Most sellers add a passkey on their phone **and** their laptop so they're never locked out of either.
</Check>

***

## 🔒 Sensitive Actions That Require a Passkey

Some account actions are sensitive enough that Shopi requires passkey verification, even if you're already logged in. This prevents an attacker who gains temporary access to your session from being able to take over your account.

<AccordionGroup>
  <Accordion title="Changing your account password" icon="key">
    Updating your password requires a passkey confirmation. This stops someone with a stolen session token from locking you out of your own account.

    <Tip>
      💡 **Fun fact:** Even if a friend picks up your unlocked phone, they still can't make sensitive changes to your Shopi account — passkey confirmation has you covered.
    </Tip>
  </Accordion>

  <Accordion title="Changing your account email" icon="envelope">
    Your account email is tied to password resets and critical notifications. Shopi requires passkey verification before it can be changed.
  </Accordion>

  <Accordion title="Removing or replacing a passkey" icon="trash">
    Deleting an existing passkey or registering a replacement requires verification with an existing passkey (or a fallback recovery method) so attackers can't simply swap in their own.
  </Accordion>

  <Accordion title="Transferring store ownership" icon="right-left">
    Ownership transfers are permanent and high-impact, so Shopi requires passkey confirmation before the transfer can be finalized.
  </Accordion>
</AccordionGroup>

<Warning>
  If a sensitive action is requested and passkey verification fails or is unavailable, Shopi will block the change rather than fall back to a weaker method. This is intentional — it's the same protection that keeps attackers out.
</Warning>

***

## 📱 Choosing a Passkey Method

<Tabs>
  <Tab title="Face ID">
    Available on iPhones, iPads, and Macs with a TrueDepth camera. When prompted, look at your device's camera to confirm. Face ID passkeys sync via iCloud Keychain across your Apple devices.
  </Tab>

  <Tab title="Fingerprint">
    Available on most modern phones and laptops with a fingerprint sensor (Touch ID, Android fingerprint unlock). Place your registered finger on the sensor when prompted.
  </Tab>

  <Tab title="Windows Hello">
    Available on Windows 10/11 devices with a fingerprint reader, IR camera, or PIN configured. Windows will prompt you directly through the system dialog.
  </Tab>

  <Tab title="External Device">
    Use a FIDO2 hardware security key (e.g. a USB or NFC key) or a nearby paired phone as a roaming authenticator. Useful for shared computers or sellers who prefer a dedicated physical key.
  </Tab>
</Tabs>

***

## ❓ Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Do I still need a password if I set up a passkey?">
    Your account keeps a password as a fallback recovery method, but day-to-day sign-in and sensitive actions can be done entirely with your passkey.
  </Accordion>

  <Accordion title="What happens if I lose my device?">
    If you have a passkey registered on another device, use that to sign in and manage your account. If all passkey devices are lost, use account recovery from the sign-in screen to verify your identity and regain access.
  </Accordion>

  <Accordion title="Can my staff accounts use passkeys too?">
    Yes. Passkeys work the same way for staff accounts with dashboard access, scoped to whatever permissions that staff account already has.
  </Accordion>

  <Accordion title="Is my biometric data sent to Shopi?">
    No. Face ID, fingerprint, and Windows Hello data never leaves your device. Shopi only receives a cryptographic confirmation that the check succeeded.
  </Accordion>
</AccordionGroup>

<Info>
  Passkeys follow the [FIDO2 / WebAuthn](https://fidoalliance.org/passkeys/) standard, the same open standard used by Google, Apple, and Microsoft. Shopi doesn't store your biometric data — only the public key needed to verify your sign-ins.
</Info>

***

## 🧭 Learn More

<CardGroup cols={2}>
  <Card title="Shopi Security Architecture" icon="shield-halved" href="/security/introduction">
    See how authentication, encryption, and infrastructure protection work together across Shopi.
  </Card>

  <Card title="Account & Staff Permissions" icon="users" href="/security/introduction">
    Learn how to create staff accounts with scoped access instead of sharing your own login.
  </Card>
</CardGroup>