Three tabs under Your account control how you sign in.

​
Password

The Password tab under Your account, with new password and confirmation fields
Enter a new password and confirm it. The minimum length is eight characters; the two fields must match before the button becomes available.

​
Passkeys

The Passkeys tab, listing registered passkeys with a field to name and register a new one
A passkey is a credential bound to a device or password manager, unlocked with biometrics or a device PIN. There is nothing to type and nothing to phish.
1

Name the device

“Work laptop”, “iPhone”. The label is how you identify it later when you need to remove one.
2

Register

Your browser prompts for biometrics or a device PIN and creates the credential.
3

Sign in with it

Sign in with a passkey on the sign-in screen. No email needed — the credential identifies the account.
Register a passkey on more than one device, or use a password manager that syncs them. A single passkey on a single laptop is a single point of failure.
Remove a passkey from its row in the list. Removing one does not affect the others.

​
Two-factor authentication

The Two-factor tab, showing enrolled factors and the option to enrol a new one
Enrolling a time-based one-time password (TOTP) factor adds a code challenge after your first factor.
1

Enrol

Name the factor — “Phone” — and scan the QR code with your authenticator app.
2

Confirm

Enter the six-digit code to verify the factor. It is not active until confirmed.
Once verified, signing in leaves your session at first-factor assurance until you clear the challenge. PolicyCodex enforces this on every route, not just the sign-in page, so reloading the app mid-session re-presents the challenge rather than letting a partially-authenticated session through.
Store your authenticator’s backup codes somewhere you can reach without the device. An enrolled factor with no recovery path can lock you out of the organisation.
Removing a factor requires confirming your identity first.

​
What to enable

Everyone

A password plus a passkey. The passkey becomes your day-to-day route in; the password is the fallback on a device where the passkey isn’t available.

Domain owners

Add a second factor. Domain owners approve standards, promote them to enforcing, and issue API keys — the account is worth protecting properly.
Screenshot and automation accounts should not have MFA enabled — an automated capture run cannot answer the challenge. Use a dedicated account with a strong password for those.