Two-factor authentication (2FA)
Passkeys (FIDO2) on ERAComing soon
A passkey is a password-free sign-in: a website sends a request, a device signs it, and the website checks the signature.
Passkeys are coming to ERA. The device is built for them and says so when you scan a passkey request; the ceremony itself arrives in a later firmware version. The sections tagged "Coming soon" describe how it will work, not something you can do today.
Before you start
Passkeys and authenticator codes live in one store on the device and share one limit: 40 entries in total, in any mix — 25 codes and 15 passkeys, for example, not 40 of each.
Until passkeys arrive, the 2FA list is headed 2FA TOTP and holds authenticator codes only.
Steps
What your device does today when a website sends a passkey request.
On the Home screen, tap SCAN QR.
ERA Home screen with SCAN QR, WALLETS, RECOVERY MANAGER, SETTINGS and 2FA tiles Point the ERA camera at the passkey QR code shown by the computer.
SCAN QR page with an empty camera frame and the hint to set your phone's brightness to max Read the answer. ERA recognises that the code is a passkey request but reads nothing further from it, and stops on COMING SOON with FIDO passkeys are not supported yet. Support is coming in a future firmware version.
COMING SOON page: FIDO passkeys are not supported yet, support is coming in a future firmware version, with a SCAN button Tap SCAN to scan another code, or the back arrow to leave the scanner.
Done
You are back on the scanner or on the Home screen. Nothing was created and nothing was sent back to the computer: the request was never read. The 2FA list still holds codes only, under the header 2FA TOTP.
How passkeys will workComing soon
These screens are built into ERA and arrive with the firmware version that turns passkeys on. Read this as a description of the feature, not as instructions.
Registering a passkeyComing soon
The request comes from an ERA app on the computer, as a QR code.
Scanning the request is the consent; there is no separate approval screen. ERA creates the key pair straight away and shows the response QR code under the header APPROVE, with DONE. The info button in the header opens a panel reading Register on, the website name and the account name — the one place the ceremony's details can be read.
Showing that QR code to the computer is what completes the registration; a response nobody scans registers nothing. Tapping DONE afterwards lands on the 2FA list.
If the store is already full, ERA stops instead with Internal storage is full. First remove one of your passkeys.
Signing in with a passkeyComing soon
The start is the same: SCAN QR on the Home screen, then the request QR code from the computer.
What ERA does next depends on the request. If it names the passkeys the website accepts, ERA uses the first one of them it holds. If it names none, ERA looks for its own passkeys for that website: one match is used at once; several bring up CHOOSE PASSKEY, where you tap the account you want, and each row reads the website and the account name.
Then the same ending as a registration: a response QR code under APPROVE — its info panel reads Sign in to — which you show to the computer, then DONE.
Leaving CHOOSE PASSKEY by the back arrow returns to the scanner and sends nothing back; the website's request times out instead.
Registering a passkey twice for the same accountComing soon
ERA never decides this for you.
If the website's own request names a passkey ERA already holds for it, the website is forbidding a second registration. ERA stops with This wallet already has a passkey for this account. Nothing is created and no QR code is shown.
Otherwise, when this website and account already have a passkey on this wallet, ERA asks. The screen is headed PASSKEY EXISTS and reads This account already has a passkey on this wallet, created %string%., then Replace makes the old one stop working on the site. Add another keeps both. The buttons are REPLACE, ADD ANOTHER and CANCEL.
The date in that sentence is the day the existing passkey was made; ERA shows nothing there when its clock was not set at the time.
Deleting a passkeyComing soon
On the Home screen, 2FA opens the list; tapping a passkey row opens its card, headed PASSKEY. The card shows the website, the account name, the day it was made (or Creation date unknown), and DELETE.
DELETE raises a confirmation reading Do you really want to delete this passkey?, with DELETE and CANCEL. Confirming removes the passkey from the device; there is no undo.
Deleting here changes nothing on the website: the site keeps listing a key that no longer answers. Remove it there too, or register a new one.
A passkey the device does not haveComing soon
If the website asks for a passkey that is not on this ERA, the device does not sign — a signature made with somebody else's passkey is one the website rejects. The screen is headed FAILED and reads This website's passkey is not on this device. There is no QR code to show, so finish the sign-in on the device that holds that passkey, or register a passkey for the site on this one.
Trouble?
COMING SOON → the firmware on your device has no passkey support. The QR code and the camera are fine; ERA read the code and recognised it.
No passkeys in the 2FA list → this firmware hides them. Its built-in help says so: This firmware supports TOTP one-time codes only. FIDO2 passkeys are coming in a future version.
The website needs a second factor now → if it also offers authenticator codes, ERA can hold that code instead. See Add an authenticator account (TOTP).