Documentation

Passkeys and two-factor sign-in

A passkey signs you in with your fingerprint, face or device PIN instead of a password. It only works on Pulsar’s own address, so a look-alike site can’t trick you into handing it over.

1. Open Settings → Account → Passkeys and choose Add a passkey. Pulsar asks you to confirm it’s you first, and with two-factor on, for a code from your second factor, a backup code or a passkey you already have.
2. Follow your browser’s prompt. Passkeys saved to iCloud Keychain, Google Password Manager or a password manager are marked Synced; ones held by a single device or security key are marked This device only.
3. Next time, choose Sign in with a passkey on the login page, or pick it from the email field’s suggestions.

You can hold up to 10 passkeys, rename them, and remove any you no longer use. Signing in with a passkey counts as two-factor on its own, because it needs both the device and your fingerprint, face or PIN. We email you whenever a passkey is added to or removed from your account. Resetting your password or signing out everywhere doesn’t remove passkeys, so if you didn’t add one, remove it under Settings → Account → Passkeys.

With two-factor on, signing in with a password asks for a second step. Once you have a passkey you can use it there instead of typing a code, whichever method you set up. You can also choose Passkey as your two-factor method in Settings → Two-factor sign-in; keep the backup codes you’re given for when you can’t use it.

Owners and admins can turn on Require two-factor sign-in in the organization’s settings. The panel lists who doesn’t use two-factor yet, and each of them gets an email when you turn it on. You need two-factor on your own account first.

• Members without two-factor can still sign in, but they can’t open that organization’s apps, releases, keys, members or settings until they turn it on. Any method counts: an authenticator app, email codes or a passkey.
• API keys and CLI sessions acting as that member are held to the same rule.
• CI tokens belong to the member who created them, so a CI token made by a member without two-factor stops working in that organization until they turn it on. CI tokens made by members with two-factor keep working.
• Deployment keys and the update checks your apps make keep working, so installs aren’t interrupted.
• Their other organizations stay open.