Skip to content

Passkeys and multi-factor sign-in

Use Account security in the user menu to manage passkeys, an authenticator app and recovery codes. You can require MFA yourself; an authorized workspace administrator can require it for individual users.

Choose a sign-in method

Method How it works
Passkey Your device, security key or password manager verifies sign-in. A verified passkey satisfies the MFA requirement.
Password and authenticator app Enter your password and a current code from the app.
Recovery code After password verification, an unused saved code starts replacement-factor setup.

Password-only sign-in is possible while neither you nor your administrator requires MFA. A first optional passkey does not automatically require MFA. Enrolling an authenticator app enables your personal MFA requirement.

Set up a passkey

  1. Open Account security, enter a passkey name and select Add passkey.
  2. Confirm your password for the first passkey. You do not need an existing passkey.
  3. Complete the browser's passkey creation flow.
  4. Save the recovery codes separately from your sign-in device and acknowledge storage.

Passkey availability depends on browser and device. If you dismiss the native browser prompt, you can retry within the still-valid step or choose an available alternative. The Nuvoca page's Cancel action ends the current flow instead.

Set up an authenticator app

  1. Select Set up authenticator app and confirm your password first. No app code is required at that step.
  2. Scan the QR code shown next with your authenticator app or enter the setup key manually.
  3. Enter a code generated by the app.
  4. Save the recovery codes and acknowledge storage to complete setup.

The ten recovery codes are displayed once. Each can be used once. Replace codes in Account security when you need new ones. Keep at least one active factor while MFA is required.

Recover access

After password verification, use an unused recovery code at the MFA step. Then enroll a replacement passkey or authenticator app and save new codes. Full access returns only after completion; old factors and codes are replaced.

Without a recovery code, ask your workspace administrator to start MFA recovery. After independently verifying your identity, they start recovery in user management and confirm with their own MFA. You receive an email with an entry link and a one-use authorization code. Enter the code and your existing password within 30 minutes and enroll the replacement factor. Administrators cannot perform this action on their own account; another authorized administrator is required.

Resetting your password does not remove MFA. If you forgot your password, reset it first, then request a new recovery email. For an expired flow or failed delivery, request a new recovery start; the protection requirement remains active.

Review team access and connected applications

Authorized administrators open a user's security actions in user management. They can require MFA for that user or remove the administrator requirement. A personal MFA requirement remains in place. Security changes may require signing in to the browser again.

MFA recovery ends browser sessions but preserves existing API keys and OAuth/MCP grants. If unauthorized access is suspected, separately revoke affected credentials under API access. New browser-based authorizations require completed recovery.

If you use the same email address for several accounts, use the account-specific sign-in link from your administrator. Nuvoca does not automatically choose an arbitrary workspace when the account is ambiguous.