> Both live under Profile → Security.
> Source: https://orochibraru.com/homerun/canary/docs/two-factor-and-passkeys · Site index: https://orochibraru.com/llms.txt

# Two-factor authentication and passkeys

Both live under **Profile → Security**.

- **Two-factor authentication** asks for a code from an authenticator app after
  your password, or after an emailed sign-in code or link. Turning it on
  (confirm your password first, if you have one) shows a QR code to scan and a
  set of **backup codes**; save those, each one signs you in once when the app
  isn't to hand. The sign-in page's code step accepts either. You can generate
  new backup codes or turn it off from the same panel.

  ![Setting up an authenticator app: the QR code, the setup key and the code field](https://orochibraru.com/images/38ad639fcc6cdb1f9f9c1a756cc7ea5dd55026c2.webp)

- **Passkeys** sign you in with Touch ID, Windows Hello, a security key or your
  password manager instead of a password. Register as many as you like, name
  them, and remove the ones you no longer use. The sign-in page offers a passkey
  button and your browser's passkey autofill.

  ![The Passkeys panel under Profile → Security](https://orochibraru.com/images/05585a1641fcf1a428364a6c8fbe4ba389f72a80.webp)

A passkey is bound to the **Dashboard URL**'s hostname (Settings → General), so
it only works when you open Homerun on that host or a subdomain of it; on any
other address the passkey option isn't offered. Set the Dashboard URL before
anyone registers one, since changing its hostname later strands every passkey
already registered. Settings → General warns before saving a Base domain or
Dashboard URL change that moves the hostname, with how many passkeys it would
strand, and asks you to confirm.