Managing Credentials
Once passkeys are in use, the ongoing work is small: keeping the registered list meaningful, and removing what should not be there.
Where to find it
Architect Panel → Security:
- Passkeys — registered credentials, their devices and last use
Architect Panel → Activity:
- Activity Log — the record of a credential being added or removed
Architect Panel → Security:
- Permissions — who may manage other people’s credentials
What to review
- Users with only one credential. Each is a lock-out waiting to happen — chase them.
- Credentials unused for a long time. Usually a device that no longer exists.
- Accounts with none at all, where you expected coverage.
The last-used timestamp makes all three answerable without asking anybody.
Removing a lost device
Remove that credential promptly, and leave the others. This is where nicknames earn their place — without them you are guessing, and guessing wrong means either leaving a lost device registered or locking somebody out.
If the user cannot say which credential was on the lost device, removing all and re-enrolling is safer than leaving one you cannot identify.
Removal is an access request
Somebody asking you to remove a credential is asking you to weaken their account — which is exactly what an attacker would ask for. Verify them as rigorously as for a password reset, and record what you did.
Step-up re-authentication
Asking somebody to prove themselves again before something consequential, even though they are already signed in — changing bank details, exporting a large dataset, altering permissions.
It is a good control because it defends against the case ordinary authentication cannot: an unattended session, or somebody using a machine that was left signed in. Signing in an hour ago says nothing about who is at the keyboard now.
Use it sparingly
Applied to routine actions it becomes an obstacle people resent and click through without reading, which is worse than not having it — you have added friction and gained nothing.
Reserve it for actions that are consequential and irreversible, and be able to explain to a user why this particular action asked.
Passkeys make it painless
Re-authenticating with a password is enough of an interruption that people avoid designs requiring it. With a passkey it is a fingerprint — quick enough that it can be used where it genuinely helps.
Watch for repeated removals
An account whose credentials are removed and re-registered repeatedly is worth a look. It is usually somebody struggling with the technology, and occasionally something else.
Worked example
A quarterly review finds nine users with a single credential; all are asked to add a second and seven do. A lost laptop is reported and its named credential removed the same morning, leaving the user's phone working. Step-up re-authentication is required only for changing supplier bank details, where it is expected rather than resented.
Recommendations
- Chase single-credential users before they become lock-outs.
- Verify identity before removing anything.
- Reserve step-up for consequential, irreversible actions.
- Review unused credentials periodically.