Passkeys, security keys and authenticator apps

A second step when you sign in means that someone who learns your password still cannot get into your DSE Client ID. You can use a passkey, a security key or an authenticator app, and you can add more than one.

To add or manage them, sign in at account.dseclients.app and choose Security.

Passkeys

A passkey lets you sign in the same way you unlock your phone or computer: with your fingerprint, your face or your screen lock PIN. It cannot be guessed, and it cannot be phished, because it only works on our real sign-in page.

Your passkey is saved by your device or password manager, for example:

• iCloud Keychain on an iPhone, iPad or Mac
• Google Password Manager on Android or in Chrome
• Windows Hello on a Windows computer
• a password manager such as 1Password or Bitwarden

Most passkeys are shared with your other devices by whatever saved them, so long as those devices can use it: iCloud Keychain shares yours with your other Apple devices, Google Password Manager with your Android devices and Chrome, and a password manager with wherever you have installed it and signed in. We show this as Available on your other devices. A passkey that Stays on this device works only on the device you added it on. Either way, it is worth adding a second passkey on another device.

To sign in with a passkey, choose Passkey on the sign-in page, or choose your passkey when your browser suggests it for the email address. To use a passkey saved on your phone to sign in on a computer, choose the option to use a phone or tablet and scan the QR code your browser shows.

Security keys

A security key is a small physical device, such as a YubiKey, that you plug into a USB port or hold near your phone. You touch it when you sign in. Some keys also ask for a PIN that you set on the key itself. We cannot see or reset that PIN.

You can only use a security key when you have it with you, so keep a spare key, or another way to sign in, in case you lose it. To add one, choose Add a security key under Security.

Authenticator apps

An authenticator app shows a new six-digit verification code every 30 seconds. Microsoft Authenticator, Google Authenticator and 1Password all work.

To set one up, choose Set up an authenticator app under Security, scan the QR code with the app, and enter the code it shows. If you cannot scan the QR code, enter the setup key shown below it instead.

If your codes are not accepted, check that your phone sets its date and time automatically. The codes depend on the clock.

If you get a new phone, check whether your authenticator app restores your accounts from a backup. If it does not, sign in another way and choose Replace authenticator app.

Recovery codes

When you add your first passkey or security key, or turn on an authenticator app, we show you ten recovery codes. Each code can be used once to sign in if you cannot use your passkey, security key or authenticator app.

• We show the codes only once. Download them, or copy them into a password manager, and keep them away from the phone with your authenticator app.
• Capital letters matter. The dash in the middle is optional.
• We email you when a code is used, and when you are running low.
• You can get a new set at any time under Security. A new set stops your old codes working.

Browsers and devices

Passkeys and security keys work in current versions of Chrome, Edge, Safari and Firefox on Windows, macOS, iPhone, iPad and Android. If the sign-in page says your browser cannot use passkeys, update your browser, try a different one, or use another way to sign in.

Signing in on a new device

• A passkey that is available on your other devices appears on the new device once you sign in there to whatever saved it, if that device can use it. An iCloud Keychain passkey will not appear on an Android phone, for example.
• Otherwise, sign in once with a passkey on your phone (scan the QR code), a security key, your authenticator app or a recovery code. Then add a passkey on the new device under Security.

Having trouble? See if you cannot sign in.