Passkeys

By the end of this page you open SkyView in a browser, touch the fingerprint reader, and you are in — no username, no password.

Before you start

Where: Settings → My account → Sign-in security → Passkeys. There is one hard requirement: you have to reach SkyView over an HTTPS domain. Open it by IP address and the card has no add button. This works in the browser today, on a computer or a phone; the phone apps cannot use passkeys yet.

1. What this is

A passkey is a key that lives on your device. When you sign in, the browser first asks for your fingerprint, your face or this device's login password to confirm that it really is you, and only then produces the key for SkyView to check. No password appears anywhere in that, so there is nothing to guess, nothing to phish, and nothing that could leak elsewhere and be tried here. Half of the key never leaves your device; what SkyView holds is the other half, which on its own gets nobody into any account.

More things can act as a passkey than you would expect:

The computer itself — Windows Hello face or PIN, Touch ID on a Mac.
Your phone — fingerprint or face, when you open SkyView in the phone's browser.
A password manager — 1Password, Bitwarden, Apple's Keychain. A key kept there syncs to your other devices along with the account.
A hardware security key — the little stick you plug into a USB port.

2. The card says passkeys need an HTTPS domain

That is a browser rule, not a SkyView limitation: a passkey is tied to a domain, and browsers will only create one for a domain with a certificate — never for an IP address, never over plain http. So if you opened http://192.168.1.10:23406, the add button is not there.

How much work is a domain

Less than you would think: you need a domain of your own, and the certificate is requested automatically from a few clicks in SkyView's web UI — no command line, and no need to open port 80. The steps are in Remote Access. Setting it up also settles the "can I watch from outside the house" question along the way.

What if home and away use two different addresses

A passkey follows the domain, so two addresses means two keys — add one on each. If you would rather not, point your LAN at the same domain as well (add a record on your router that resolves that domain to the machine at home).

3. Adding one

1
Open Sign-in security
Where: Settings → My account → Sign-in security → "Passkeys".
2
Click "Add a passkey"
What to do: give it a name, such as "Study desktop" or "My phone". Once you have several devices, that name is how you tell which one to remove.
3
Follow the system prompt
What to do: from here your operating system or browser takes over — touch the fingerprint reader, look at the camera, or type this device's login password. If you want the key kept in a password manager, the prompt usually lets you choose where it goes.
4
Check that it is there
How you know it worked: a row appears in the list, showing when it was added and "Never used".

4. Signing in with it

Sign out and look at the sign-in page: below the password box there is now "Sign in with a passkey". Click it, touch the reader, and you are straight in — you do not even type a username, because the key already knows who you are.

It can also serve purely as the second step: on an account with the authenticator app turned on, the step after your password offers "Confirm with a passkey", so a fingerprint stands in for typing 6 digits. The two uses do not conflict — take whichever is handier at the time.

5. Managing the keys you have

Rename — names are how you tell devices apart once there are several, and you can change them at any time.
Remove — afterwards that device can no longer sign in with it; password sign-in is unaffected. Lost phone, computer passed on to someone else: come here and remove it first thing.
The "Synced" tag — it means the key lives in a password manager or a system account and works on your other devices too. A key without the tag only works on the device it was added on.
Last used — one that permanently reads "Never used" was most likely added and then never used again, or added on a different domain from the one you are on now.

6. Change the domain and the old keys stop working

This is by design, not a fault

To make phishing impossible, browsers tie every passkey to the exact domain it was created for — change the domain and the key is not recognised, even though the same server and the same account sit behind it. So after a domain change the old entries are still listed, but signing in reports that no usable key was found. Remove them and add one again on the new domain. Password sign-in keeps working throughout.

7. Other limits

Not supported in the phone apps yet — for the apps to use a passkey, Apple's and Google's servers have to fetch a pairing file from your server over the public internet, and SkyView runs in your own home, which rules that out. To use one on a phone, open SkyView in the phone's browser.
Very old browsers cannot do it — anything Chrome, Edge, Safari or Firefox has shipped in the last few years is fine.
It does not replace your password — SkyView will not disable your password because you added a passkey. Lose every key and the password still gets you in; there is no way to end up locked out.

8. Common questions

Nothing happens when I click, or it says cancelled — the system prompt was dismissed (sometimes it is hiding behind another window). Click again.
It says a passkey from this device is already registered — one device keeps one key per SkyView; that is the browser's rule. To change what it is called use "Rename" rather than removing and adding it again.
I have a new phone — keys synced through a password manager or a system account come with you; one that only ever lived on the old handset cannot be moved, so add one on the new phone and remove the old entry while you are there.
Could somebody at home sign in to my account with their fingerprint — no. The "is this really you" part is handled by your phone or computer, and somebody else's fingerprint does not unlock your device, so the key never comes out.

Two-Step Verification — authenticator app and recovery codes
Remote Access — setting up a domain and an automatic certificate
Single Sign-On — sign in with accounts you already have

Was this page helpful?