Passkeys, Steam sign-in and required two-factor

Add a passkey, connect Steam to your account, and make two-factor compulsory for everyone in your organisation. Every plan.

Using the dashboardUpdated 2 min read

All three are on every plan, including Free.

Add a passkey

Open Settings, then Security, and choose Add a passkey. Your browser asks your device (fingerprint, face, PIN or a security key) to make one, and you give it a name. You can have up to 10.

  • On the sign-in page, choose Sign in with a passkey. A passkey with your device's lock counts as both sign-in steps, so no code is needed.
  • After a password or Steam sign-in, a passkey can be your second step instead of an authenticator code.
  • If your account had no two-factor before, adding the first passkey creates 10 recovery codes and signs out your other sessions. Save the codes.

Removing your last passkey, with no authenticator app, turns two-factor off and deletes the recovery codes. ServerStats keeps only the passkey's public key, its name and when it was added and last used.

Connect Steam

In Settings, Security, connect Steam while you are signed in. After that you can use Continue with Steam on the sign-in page. Steam never creates a new account, because Steam doesn't share an email address. If two-factor is on, Steam sign-in still asks for it. Your Steam ID is stored encrypted and is never linked to player data. You can remove it in the same place, as long as you keep another way to sign in.

Require two-factor for every member

An owner opens the organisation's Two-factor for members panel and turns on Require two-factor for every member. The owner needs two-factor on their own account first.

  • Choose a grace period from 0 to 30 days (7 by default). It counts from when the rule is turned on, or from when someone joins, whichever is later.
  • An authenticator app or one passkey meets the rule.
  • After the deadline, a member without either can reach only their own account settings until they set one up. Read-only API tokens keep working.
  • If someone loses their device, an owner or admin can give that member up to 14 more days (not themselves). The owner can always turn the rule off.

Turning the rule on or off, changing the grace period and every extension are recorded in the audit log.

Related

Getting startedCreate your accountSign up with an email and password, or with Discord or Google. Free is one server, no card and no time limit.Using the dashboardInvite your team and set rolesSettings, Team & roles. Invite by email, pick a role, and let the owner change what each role may see.Using the dashboardSettingsServer settings (General, Gamemode, Data sources, Data collection, Public page, Import Plan, Remote actions) and organisation settings.
Still stuck? Email [email protected] with the server name and what you see. For a rejected claim code or no data, include the output of the agent’s status command.