Passkey-first auth

Operator sign-in

Use a passkey first. TOTP remains available as the fallback path if the passkey is unavailable.

Passkey
Preferred path. Uses the username to scope the allowed credentials before opening the browser passkey chooser.
TOTP fallback
Use a recovery code instead
SetupRecovery