How to Set Up Passkey Login for Passwordless Access
Enable WebAuthn passkeys on your Midas account for fast, phishing-resistant biometric sign-in using Face ID, Touch ID, or Windows Hello.
A passkey replaces the trip to your inbox with the biometric you already use to unlock your device. The private half never leaves the phone or laptop it was created on and never reaches Midas, which is what makes it phishing-resistant: there is no code to read out and no link to intercept. Register one per device you actually use, and keep the magic link and 2FA as the way back in from anywhere else.
Before you start
- A device with a screen lock and biometrics — Face ID, Touch ID, Windows Hello or an Android fingerprint sensor.
- An up-to-date browser or the Midas app. Passkeys need a platform that supports WebAuthn.
- A second way to sign in kept alive — magic link or 2FA — for the day the device is not with you.
Navigate to Passkey Settings
Go to Profile > Security > Passkey Management. This screen shows any passkeys currently registered to your account and allows you to add new ones.
Tap Register New Passkey
Tap the 'Register New Passkey' button. Your device will prompt you to authenticate using its built-in biometric: Face ID on iPhone, fingerprint on Android, Touch ID on Mac, or Windows Hello on PC.
Complete Biometric Verification
Authenticate with your face, fingerprint, or device PIN as prompted. The device creates a unique cryptographic key pair. The private key stays securely on your device and never leaves it. The public key is sent to Midas for future login verification.
Name Your Passkey
Give the passkey a recognizable name such as 'iPhone 15' or 'MacBook Pro' so you can identify which device it belongs to if you register multiple passkeys. Tap 'Save' to finish.
Sign In with Your Passkey
On your next login, choose 'Sign in with Passkey' on the login screen. Authenticate with your biometric, and you will be signed in instantly. Passkeys are phishing-resistant because they are bound to the Midas domain and cannot be intercepted by fake websites.
If something goes wrong
- The device never offers to create a passkey.
- Check that a screen lock and biometrics are enabled, that the browser is current, and that you are not in a private or incognito window, which blocks passkey storage on most platforms.
- The passkey works on one device but not another.
- That is how it is meant to behave unless your platform syncs passkeys through iCloud Keychain or Google Password Manager. Register a passkey on each device you use regularly rather than expecting one to travel.
- You replaced the phone and the passkey is gone.
- Sign in with the magic link or an authenticator code, remove the passkey belonging to the old device, and register a new one. Leaving dead passkeys on the account is untidy rather than unsafe, but removing them keeps the list meaningful.
Frequently asked questions
- Is a passkey safer than a password?
- Yes, on the two failure modes that matter. There is nothing to reuse across sites and nothing an attacker can phish, because the secret never leaves your device and never travels to the server.
- Can somebody with my phone sign in as me?
- Only if they can also pass its biometric or screen lock. The passkey is bound to that unlock, which is why a device with no lock code cannot register one.
- How many passkeys can I register?
- Several — one per device is the sensible pattern: phone, laptop, tablet. Name them at registration so the list tells you which device each belongs to when you come to remove one.
- What happens if I lose every device with a passkey?
- You fall back to the magic link and, if it is enabled, your authenticator or backup codes. That is precisely why the fallback is worth keeping alive rather than switching to passkeys alone.