Signing in, and what to do when you can't

Choose Log in / Sign up. The first screen asks one thing, your email address, with Continue under it and any Google or Apple button below that. Everything that proves it is you comes on the next screen.

One way in: the one you set up last

Each account signs in one way, and Kabora asks for that one:

• An emailed code. Six digits, good for 10 minutes. Every account has it.
• A passkey. Your device's face, fingerprint or screen lock proves it is you. Nothing is typed, so nothing can be read over your shoulder or copied from a leak.
• An authenticator app. The six-digit code the app shows, typed into a small window of its own.

The one you set up most recently is the one asked for. To change it, open Sign-in & security — Account settings → Sign-in & security on your account, or Settings → Security → Sign in in a host's dashboard — and press Use this beside another one under Sign in with. One proof is the whole sign-in; you are never asked for two.

Whichever it is, the emailed code is one press away: Email me a code instead on the passkey screen, and Use a different way, then Email me a code instead, in the authenticator window. Use a different way on the code screen offers your passkey instead, and a password if the account still has one.

A password from a browser Kabora has not seen before is followed by an emailed code. That is the only time one sign-in asks two things.

Adding a passkey

Kabora offers one once: right after the code that makes a new account. Not on later sign-ins, and not after Google or Apple. After that, it is Sign-in & security → Passkeys → Add a passkey, on kabora.app or in the Kabora app. Your device asks once and it is done, and the new key becomes your way in. Add one on your phone as well as your laptop — two keys means losing one is an inconvenience rather than a locked door.

Renaming and removing one is the same screen. Once you have a passkey, removing one asks you to confirm with a passkey you still have, so somebody who gets into your email cannot swap them. Lost the device? Lost the device one of these is on? on that screen emails you a code; entering it removes your passkeys and puts the account back on emailed codes.

In the Kabora app

The app asks for your passkey the same way, and falls back to an emailed code when the key is not on the phone. It has no authenticator step: an account that signs in with an authenticator app gets an emailed code in the app instead.

When a passkey is refused

Picking the wrong key is ordinary — most people have several, and browsers offer them all. What each message means:

• "That passkey couldn't be used here." The check failed — often the key that answered was not your Kabora one. Press the button again and choose the Kabora one, or use an emailed code.
• "That passkey isn't registered here." The key is real, but this account has never registered it, or it has since been removed. Sign in with an emailed code, then add it under Sign-in & security.
• "That request expired." You took longer than a few minutes, or the prompt was already used. Press the button again.
• "That passkey looks cloned." Two things answered for one key. Do not ignore this one: sign in with an emailed code instead, remove that passkey under Sign-in & security, and add a fresh one.

If a sign-in never finishes — the button sits on "One moment…" and nothing happens — reload the page and use an emailed code. Then tell us, because that is a fault on our side, not yours.

If the prompt appears and nothing happens

Sometimes the system window opens and then just sits there — most often on a machine that does not hold your key, or in Safari. Close it and press Email me a code instead. That is what it is for, not only for a lost device. Once you are in, add a passkey for the machine you are actually on, which stops it happening again there.

Authenticator codes

Codes change every 30 seconds. Ten wrong ones in a day stop the authenticator for that account until the time the message names; a right code never counts against you. No phone? One of your backup codes goes in the same box.

If you cannot get in at all

Email support@kabora.app from the address on the account. Kabora staff cannot see or reset your passkeys or your authenticator for you, and nobody can talk their way past them on your behalf — which is exactly what makes them worth having.