# Passkeys explained

Sentilai has no passwords. Not "passwords plus MFA" — no password field exists anywhere.
This surprises people, so here is the reasoning and the practical consequence.

## Why

A password can be phished, reused, guessed or leaked from somewhere else. A passkey is a
key pair: the private half stays in your device's secure hardware and never travels, and
the authentication is bound to the site it was created for. A convincing fake login page
gets nothing, because there is nothing to type.

For a product whose whole purpose is controlling access to your organization's AI traffic,
anything weaker would be inconsistent.

## What it looks like

Touch ID, Windows Hello, a hardware security key, or your phone. Whatever your device
offers.

## The one real risk: losing your only device

There is no password to fall back on. If your only passkey lives on a laptop and the
laptop is gone, an admin must send you a new setup link — and if *you* are the only admin,
that becomes a support ticket.

**So register a second passkey**, on a different device, from **Account & Profile**. The
console nags you about this on the Overview screen until you do, which is deliberate.

## Removing passkeys

You can remove any passkey except your last one — that request is refused. Removing the
last one would lock you out permanently, and no amount of confirmation dialog makes that a
good outcome.

## For developers

Same thing, from the Endpoint Suite's browser sign-in. Their passkey is what ties a
device to a person, which is what makes the Activity feed's Developer column meaningful.