Use a passkey to approve CLI and API keys

You run ef init, the Connect a device page opens, you click Connect, and the app wants a 6-digit code from your authenticator app. Your passkey sits on the laptop in front of you, yet you still go looking for your phone.

The enemy is a second factor you have to fetch from another device.

When your account has a passkey, the Confirm it's you window for connecting the ef CLI and for creating an API key now offers Confirm with passkey first. Your device asks for your fingerprint, face or PIN, and the connection or the new key goes through on its own. Use authenticator code instead switches to the code field. On an account with a passkey and no authenticator app, the link reads Use a recovery code instead. One confirmation covers the next 10 minutes.

The passkey buttons on the sign-in page and in this window also tell you what is happening now. A spinner shows while your browser opens the passkey prompt, and once you approve, the button says it is signing you in or confirming until the page moves on. Close the prompt and a short note says it was cancelled, with the button ready for another try. A passkey the server refuses, a lost connection and an expired page each get their own message.

Try it: add a passkey in Account settings, Two factor. Then go to Settings, API in your project, click Create API key and pick Confirm with passkey.