Passkeys
Sign in to the Console and Agoo Workspace with your face, fingerprint, screen lock or a security key, with no password to type and no code after.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
A passkey lets you sign in with the same thing you use to unlock your phone or computer: your face, your fingerprint, your screen lock, or a small security key you plug in or hold to your phone. There's no password to type and no six-digit code after, because a passkey already counts as two steps: something you have (the device) and something you are or know (your face, finger or PIN).
Passkeys can't be phished. A passkey only answers to Agoo's real address, so a fake page that copies Agoo's look gets nothing from it, even if you're fooled into opening it.
Rolling out in early access
When passkeys are on for your account you'll see Passkeys in Account → Sign-in and security in the Console, and Sign in with a passkey on the sign-in page and in Agoo Workspace. Your password, email codes and authenticator keep working as they do today.
What works where
One passkey signs you in to everything you use at work:
| Where | How |
|---|---|
| The Console in a browser | Sign in with a passkey, or pick it from the suggestions in the email field |
| Agoo Workspace on iPhone and iPad | Sign in with a passkey: Face ID, Touch ID or your passcode |
| Agoo Workspace on Android | Sign in with a passkey: your fingerprint, face unlock or screen lock |
| A security key | Any of the above: choose to use a security key, then plug it in or hold it to the phone |
A passkey made on your iPhone is kept in your Passwords app (iCloud Keychain) and reaches your other Apple devices; on Android it's kept in Google Password Manager and reaches your other Android devices and Chrome. A password manager such as 1Password or Bitwarden can hold them too. Agoo Reviews and Agoo Forms have passkeys of their own, kept separately.
Add a passkey
Open Passkeys
In the Console, go to Account → Sign-in and security → Passkeys and choose Add a passkey. In Agoo Workspace, it's Account → Security → Passkeys.
Confirm it's you
Enter the six-digit code from your authenticator app. If you don't use one, Agoo emails you a code instead. If you already have a passkey, you can confirm with that.
Make the passkey
Your device asks for your face, fingerprint or screen lock, and saves the passkey. To use a security key instead, choose the security key option and plug it in or hold it to your phone.
You'll get an email whenever a passkey is added to or removed from your account, so you'd know if it wasn't you. Add a second one (another device, or a security key) as a spare. You can keep up to ten.
Sign in with a passkey
Choose Sign in with a passkey on the Console's sign-in page or in Agoo Workspace, then unlock as your device asks. You're in, with no code after. If Agoo asks for your authenticator's code after a password, you can choose Use a passkey there instead.
Remove a passkey
Open Passkeys, choose Remove beside it, and confirm it's you the same way as when adding one. The passkey stops signing you in to Agoo straight away. It stays in your phone's password manager until you delete it there too.
Your organisation's rules still apply
A passkey proves it's you; your organisation still decides what you can open. Organisations that ask everyone to use Google or Microsoft, or ask for two-step verification, accept a passkey as two-step verification.
Agoo's own staff
People who work for Agoo are moving to security keys for Agoo's own administration, so that a stolen password and authenticator code alone can't open it. Agoo staff only ever look at your organisation's records through support access, which you see and can end.
Related
Two-step verification
Set up an authenticator app so Agoo asks for a six-digit code each time you sign in, step by step for first-timers.
Sign-ins and sessions
How long Agoo keeps you signed in, where you're signed in, the alert for a new device, and how Owners and Admins sign someone out everywhere or make sign-ins shorter.