Passkeys and two-step verification

Two optional features make your Imagina account harder to break into: passkeys, which let you sign in without a password, and two-step verification, which asks for your passkey or a code from your phone after your password. Both live in Settings > Security.

Passkeys

A passkey signs you in with your fingerprint, your face or your device's screen lock, instead of a password. It is saved by your device or your password manager (Google Password Manager, iCloud Keychain, 1Password, Bitwarden...), and a synced passkey works on all your devices.

A passkey is the safest way to sign in. It cannot be guessed, reused on another site or typed into a fake login page, and it already counts as two factors: the device that holds it, and the fingerprint, face or PIN that unlocks it. That is why no code is asked after a passkey, even with two-step verification on.

Adding one

In Settings > Security, under Sign-in methods, press Add a passkey and follow your browser's prompt. The passkey is named after the browser and system it was made on. Press the pencil next to a name to rename it.

You can add as many as you like, for example one per device. Each one shows when it was added, and whether it is synced across your devices or stays on the one that made it.

Signing in with one

On the sign-in page, press Sign in with a passkey. Many browsers also offer your passkey as soon as you click the email field. You do not need to type your email. In Chrome, pressing Sign in anywhere on Imagina offers a passkey saved on your device right away, without opening the sign-in page.

In the Android and iOS apps

Signing in with a passkey works in the apps: their sign-in page opens in your phone's browser, where passkeys work like on the web. Adding a passkey has to happen in a web browser, on your phone or your computer. The app then lets you sign in with it too.

Removing one

Press Remove next to it. Then delete it from your password manager or device as well, or it will keep showing up in your browser's suggestions.

Two-step verification

With two-step verification on, signing in with your email and password also asks for a second proof: your passkey, or a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in.

It applies to password sign-in only. Signing in with Google, Discord or Apple relies on that account's own protection, so turn on two-step verification there too. Signing in with a passkey never asks for a code.

Passkey after password

If you already have a passkey, this is the simplest option. Turn on Passkey after password under Two-step verification and enter your password. From then on, signing in with your password also asks for your passkey. Signing in with the passkey alone still works as before.

Imagina downloads your backup codes as imagina-backup-codes.txt when you turn it on and shows them once. Keep the file somewhere safe. A backup code signs you in if your passkey is gone.

While it is on, your last passkey cannot be removed. Add another one, or turn the option off first.

Turning on the authenticator app

You need a password on your account. If you signed up with Google, Discord or Apple, set one first in Settings > Security.

1. In Settings > Security, under Two-step verification, press Set up next to Authenticator app and enter your password.
2. Scan the QR code with an authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. If you cannot scan it, type the key shown under it into the app.
3. Enter the 6-digit code the app shows, and press Turn on.

Backup codes

When you turn on two-step verification, Imagina shows 10 backup codes. Each one signs you in once, in place of your passkey or a code from the app, if you lose your device. They are shown only once: download, copy or print them, and keep them somewhere other than your phone.

Support cannot turn off two-step verification for you. If you lose your device and your backup codes, there is no way back into a password sign-in. A linked Google, Discord or Apple account, or a passkey you still have, gets you in, which is a good reason to add one.

To get a fresh set, press New codes next to Backup codes. The old ones stop working at once.

Signing in

After your password, use your passkey or enter the code from your app. If you have a passkey, its prompt opens on its own. If you tick Trust this device for 30 days, that browser is not asked again for a month.

Lost your device? Pick Use a backup code on that screen. Too many wrong codes lock the code step for 15 minutes.

If the code is always refused, check that your phone's clock is set automatically. Codes are based on the time, so a clock that drifts by more than a minute produces codes Imagina will not accept.

Turning it off

Turn off Passkey after password, or press Turn off next to Authenticator app, and enter your password. Your password alone signs you in again, and the backup codes stop working.

"Confirm it's you"

Adding a passkey or disconnecting a sign-in method needs a recent sign-in. If you signed in more than a day ago, Imagina asks you to confirm it is you first, with your password (and your code, if the authenticator app is on), one of your passkeys, or a linked Google, Discord or Apple account. With Passkey after password on, your password alone cannot confirm it, so use a passkey or a linked account. You stay signed in, and the action continues once you have confirmed.