> Both live under Profile → Security.
> Source: https://orochibraru.com/homerun/docs/two-factor-and-passkeys · Site index: https://orochibraru.com/llms.txt

# Two-factor authentication and passkeys

Both live under **Profile → Security**.

- **Two-factor authentication** asks for a code from an authenticator app after
  your password. Turning it on (confirm your password first, if you have one)
  shows a QR code to scan and a set of **backup codes**; save those, each one
  signs you in once when the app isn't to hand. The sign-in page's code step
  accepts either. You can generate new backup codes or turn it off from the same
  panel.
- **Passkeys** sign you in with Touch ID, Windows Hello, a security key or your
  password manager instead of a password. Register as many as you like, name
  them, and remove the ones you no longer use. The sign-in page offers a passkey
  button and your browser's passkey autofill.

A passkey is bound to the **Dashboard URL**'s hostname (Settings → General), so
it only works when you open Homerun on that host or a subdomain of it; on any
other address the passkey option isn't offered. Set the Dashboard URL before
anyone registers one, since changing its hostname later strands every passkey
already registered. Settings → General warns before saving a Base domain or
Dashboard URL change that moves the hostname, with how many passkeys it would
strand, and asks you to confirm.