Sign in with your fingerprint, face or PIN

You sign in from a café, type your password, then dig your phone out of a bag for a six-digit code that expires before you can read it out.

The enemy is a sign-in that a fake login page can copy, one code at a time.

You can now add passkeys to your ElasticFunnels account in Account settings, Two factor. Name each one after the device it lives on. The list shows when each passkey was added and when it was last used, and Remove takes one away after you confirm it is you. A passkey works with your fingerprint, your face or your device PIN, and it only answers on app.elasticfunnels.io, so a look-alike page has nothing to collect.

Once you have one, the sign-in page has a Sign in with a passkey button that needs no e-mail or password. If you sign in with your password, the next step asks for your passkey first. Other ways to sign in lists your authenticator app, a recovery code and a way to reach support when you have lost everything.

A passkey counts as two-factor authentication everywhere the app asks for it, including before you create or show an API key and before you sign out your other sessions. Your recovery codes keep working alongside it.

Try it: open Account settings, Two factor, type a name such as MacBook, click Add a passkey and follow your browser's prompt.