A passkey lets you sign in to ByteExchange and confirm withdrawals with your fingerprint, face, device PIN or a hardware security key instead of typing a password. You add one in Settings → Security → Passkeys (Biometrics). At withdrawal, a passkey replaces the authenticator code; the e-mail code and your fund password are still asked.
What a passkey is
A passkey is a digital key stored on your mobile, computer, password manager or a hardware key such as a YubiKey. It answers only to the real ByteExchange website, which makes it highly resistant to phishing, and there is nothing to type that someone could copy. If your passkey provider syncs across devices, the same passkey works on each of them.
A passkey is one of the three withdrawal keys on ByteExchange, together with an authenticator app and a fund password. Every withdrawal needs the e-mail code plus at least one of them.
Add a passkey
- Go to Settings → Security. The Passkeys (Biometrics) card appears in browsers that support passkeys.
- Tap Manage.
- Confirm it is you: enter your authenticator app code, or request a code by e-mail and enter it.
- Tap + Register New Passkey and follow your device's prompt (fingerprint, face, PIN or security key).
- You will see Passkey registered successfully! and the new passkey appears in the list.
You can register up to 10 passkeys, for example one per device. If you add a passkey while no authenticator app is on, withdrawals pause for 24 hours first (see Why withdrawals are paused).
Sign in with a passkey
- On the sign-in page, choose Sign in with Passkey.
- Enter your account e-mail.
- Tap Continue with Passkey and approve the prompt on your device.
A passkey sign-in counts as both your password and your second factor. On a shared device you can choose Don't use passkey on this device.
Confirm a withdrawal with a passkey
- Start a withdrawal from Funds as usual.
- At the confirmation step, tap Verify with Passkey and approve the prompt.
- You will see Passkey verified — the authenticator code is skipped.
- Enter the e-mail verification code, plus your fund password if you have one.
If a passkey is the only withdrawal key on your account, withdrawals are confirmed with it. To have another way in, add an authenticator app or a fund password as well.
Remove a passkey
- In Settings → Security, open Passkeys (Biometrics) → Manage.
- Enter your authenticator code, or request and enter an e-mailed code.
- Tap Delete next to the passkey and confirm.
Removing a passkey pauses withdrawals for 24 hours and returns your saved withdrawal addresses to "new" status.
FAQ
Does a passkey replace the e-mail code at withdrawal?
A passkey replaces the authenticator code only. The e-mail verification code is always asked, and so is your fund password if you set one.
Can I use the same passkey on my mobile and laptop?
Yes, if your passkey provider (for example your mobile's password manager) syncs it across your devices. You can also register a separate passkey on each device, up to 10 in total.
What happens if I lose the device with my passkey?
Sign in with your password and authenticator app or another passkey, then delete the lost passkey in Settings → Security. If you lost every way in, you can use your Master Key at bexc.io/recover, or contact support.
Why don't I see the Passkeys card?
The card appears in browsers that support passkeys. Update your browser or open bexc.io in a current version of Chrome, Safari, Edge or Firefox.