Passkeys are an optional way to sign in using your device or a security key, without typing a password. Email codes, supported Google or Microsoft sign-in, and supplier-managed usernames and passwords remain available.
Add a passkeyLink to this section#
Sign in normally first. Choose Your passkeys from your staff workspace account controls, the phone's More menu, your customer portal account menu, or Your workspaces. Give the key a useful name, choose Add a passkey, then follow your browser or device instructions. A recent sign-in is required; if asked, sign out and sign in again first.
Only add a passkey on a device you trust. Passkeys are unavailable to anonymous demo accounts and review logins. They do not create a workspace or grant access to a supplier.
Use a passkeyLink to this section#
Choose Sign in with a passkey under the sign-in form, in line with the other sign-in buttons, and follow the device prompt. Your browser must support passkeys and the page must use a secure connection. Local development can use localhost.
A passkey is tied to the site where you added it. A key added on the main TradeCatalog site does not sign you into a supplier's branded address, or the reverse. Add a separate key on each address you use. A site name is included in each key's label to help you recognize it.
Remove a key and recover accessLink to this section#
Open Your passkeys, choose the key's Remove button and confirm. That key stops signing you in. Existing signed-in sessions stay active. Keep access to your email, another passkey, or your supplier-managed username and password before removing your last key.
For a supplier-managed username login, a supplier password reset removes its passkeys and ends its sessions. Sign in with the replacement password, then add a new passkey if you want one. Removing that login also removes its saved credentials.
TradeCatalog stores the public credential needed to check a sign-in. The private key stays with your device, security key or passkey provider. Adding and removing passkeys are recorded as account security events.