Skip to content
Get started →

Contents

Two-factor authentication and passkeys

Last updated: October 24, 2026

What it does

Two-Factor Authentication is on the profile page, under Change Password. A badge at the top of the panel says whether you have a second factor set up.

With none set up, the panel offers Enable 2FA. With one, the Authenticator App row reads Enabled or Not configured, with Enable or Disable beside it.

Passkeys is the second half of the panel. It lists your passkeys by name and the date each was last used, and offers Add Passkey. A passkey signs you in without a password and counts as a second factor.

Setting up the authenticator app gives you backup codes, and so does your first passkey. They appear once. Copy and Download are beside them, and that step closes only when you select I’ve Saved These Codes.

Confirm It’s You is the window Lucrii opens before some changes, once 10 minutes have passed since you logged in or last confirmed. It says what you are confirming for, as in “Confirm it’s you to add a passkey.” Lucrii asks before you:

  • Turn two-factor authentication on or off, or add or remove a passkey.
  • Change your email address, on an account with no password.
  • Approve an MCP client’s connection, or a sign-in from the Lucrii command line.
  • Install an app, approve an app update’s new permissions, or connect an account to an app.
  • Make someone an Administrator or Owner, by inviting them, resending their invitation or changing their role.

The window offers Passkey, Authenticator Code and Password, in that order, where your account signs in that way. It opens on the first one your account has, and Method switches between them where there are more. Use Passkey opens your browser’s passkey prompt. Password and Authenticator Code take your password or the six-digit code from your authenticator app, then Confirm. A backup code doesn’t confirm it’s you.

An account on an address or in an organisation that requires single sign-on confirms with Continue with Google only. So does an account whose only way in is Google. Continue with Google opens a Google window, where you choose the Google account this Lucrii account signs in with. Closing that window stops that try and leaves Confirm It’s You open.

Once you confirm, Lucrii carries on with the change you asked for. Cancel leaves the change undone.

Enable 2FA, Enable and Add Passkey ask before their setup window opens, when 10 minutes have passed.

Before you start

A password reset that confirms an account’s email address removes the passkeys and authenticator app set up before it. So does the link in the verification email, opened anywhere but a browser logged in to the account. A Google sign-in that confirms it removes them too, unless the account already signs in with that Google account. Signing up and logging in, Verifying your email address and Resetting your password say when that happens.

Lucrii asks for your current password before you change your email address or your password, on an account with a password. Turning two-factor authentication on or off, and adding or removing a passkey, ask for no password. They open Confirm It’s You once the 10 minutes have passed.

A password or an authenticator code entered in Confirm It’s You, and a current password, share one allowance of five tries. Each one you enter uses one, right or wrong. One more try comes back every 5 minutes. With none left, Lucrii says “You have entered your password too many times. Wait 5 minutes and try again.”

If you signed up through Google, you have no password. Changing your email address then opens Confirm It’s You once the 10 minutes have passed. Change Password answers “Your account has no password to change.”

The Passkeys section only shows up in a browser that supports passkeys.

A Passkey Name can be up to 100 characters.

You can only see your backup codes while the setup panel is open. Save them then. You will not see them again. Each code works once.

Turning off the authenticator app removes it from your account. Setting it up again gives you a new set of backup codes.

How to use it

  1. Open Settings, then Profile, and scroll to Two-Factor Authentication.
  2. Select Enable 2FA. Confirm it’s you if Lucrii asks.
  3. Scan the QR code with your authenticator app, or copy the code shown beneath it.
  4. Select Enter Code, type the six-digit code, and select Verify.
  5. Copy or download the backup codes, then select I’ve Saved These Codes.
  6. To add a passkey, select Add Passkey, give the device a name, and select Register Passkey. Follow your browser’s prompt.

Troubleshooting

The panel says your two-factor status could not be loaded. Lucrii cannot check it right now, so a new email address on your profile shows Current Password. An account with no password leaves it blank.

Confirm It’s You says “Lucrii couldn’t load how to confirm it’s you. Try again.” Lucrii could not read how your account signs in. Cancel and try the change again.

Confirm It’s You says “Your account confirms it’s you with a passkey, which this browser can’t use. Open Lucrii in a browser that supports passkeys to confirm.” A passkey is the only way your account can confirm, and this browser doesn’t support passkeys. Open Lucrii in one that does.

Confirm It’s You says “Use the Google account this Lucrii account signs in with.” The Google window was answered by a different Google account. Select Continue with Google again and choose the account this Lucrii account signs in with.

The Add Passkey window reads “Confirmed. Select Register Passkey to add it.” The 10 minutes passed while the window was open, and you confirmed it’s you. Select Register Passkey once more to open the browser’s prompt.

Confirm It’s You says “Lucrii couldn’t confirm it’s you. Try again.” Google refused for another reason, or the change still asked again after you confirmed. Try again.

  • Your profile: Edit your name, email, picture, personal email signature and password on the profile page.
  • Members and invitations: See everyone in your organisation, invite people with a role, reassign roles and revoke access.

Changes