Both are optional, on every account, in the app and on the website. You set them up in Settings, then Security on the website, or You, then Sign-in and security in the app. Adding or changing either asks you to confirm it's you first.
Passkeys
A passkey lets you sign in with your fingerprint, face or screen lock instead of an email code. It stays on your device or in your password manager or cloud keychain; we keep only a public key. A passkey works on the website and in the app, and counts as both steps if two-step sign-in is on.
- Add one: choose Add a passkey, confirm it's you, then follow your device's prompt. You can give it a name, such as "Work laptop".
- Use one: on the sign-in page choose Sign in with a passkey, or pick it from your email field's suggestions. In the app, it's a button on the first screen.
- Rename or remove one: the same page lists your passkeys with when you added and last used them. Removing one means you can no longer sign in with it.
Passkeys are tied to 50heads.com. Phones and computers that sync passkeys (through iCloud Keychain, Google Password Manager or a password manager) make them available on your other devices.
Two-step sign-in
With two-step sign-in on, signing in with an email code, an email link, Google or Apple also asks for a second step: a code from an authenticator app, a passkey, or a recovery code. Signing in with a passkey needs nothing more.
Turn it on with an authenticator app
- Choose Set up under Authenticator app and confirm it's you.
- Scan the QR code, or type the key, into an app that shows 6-digit codes, such as Google Authenticator or 1Password.
- Enter the 6-digit code to finish. We then show your recovery codes.
Turn it on with passkeys only: if you have a passkey and no authenticator app, choose Turn on with your passkeys.
When you sign in on a browser, you can choose Remember this browser for 30 days so it doesn't ask again there. The app remembers your phone once you have done the second step on it. Forget them in Security makes every remembered browser and phone ask again.
Turn it off: choose Turn off in Security and confirm. The authenticator app and recovery codes are removed; passkeys stay. If the authenticator app was your only second step, removing it turns two-step sign-in off.
Recovery codes
Turning two-step sign-in on gives you 10 recovery codes. Each works once, in place of an authenticator code or a passkey.
- We show them once only. Copy or download them and keep them somewhere safe, away from your phone.
- Make new codes replaces all ten; the old ones stop working.
- Security shows how many you have left.
- Five wrong tries on a second-step code end that sign-in. After too many wrong codes in a short time we stop accepting codes for 15 minutes (a passkey still works) and email you.
Actions that ask for more
With two-step sign-in on, changes that move money or weaken your account need the second step as well: payout methods, tax details, withdrawals, API keys, and adding or removing a passkey, an authenticator app or recovery codes. Your confirmation lasts 10 minutes. If your organization asks everyone for two-step sign-in or a passkey, you may need to add one before these actions work.
If you lose every way in
If you lose your phone and your recovery codes, use the contact form from the email address on your account. We check it's you, which may include a code sent to your email or phone, and recent activity on the account. If the account has a payout method or a balance over US$67, we wait 24 hours before the reset and email you, so you can tell us if it wasn't you. Then we turn two-step sign-in off, and we ask you to turn it back on once you're in.
We never ask for your recovery codes, an authenticator code or a sign-in code by email, message or phone.
More about the other ways to sign in: Signing in and linked accounts.