You may already be using Multi-Factor Authentication (MFA) with a one-time password (OTP) — a six-digit code generated by an authenticator app each time you log in. This is a solid step forward in protecting your account, and we strongly encouraged it. However, OTP has a well-known limitation: it can still be defeated by phishing.

If a member of your team is tricked into entering their username, password, and OTP on a convincing fake login page, an attacker can use those credentials in real time to gain access to your systems. The code is valid for a short window, and that is all an attacker needs. There is no technical fix for this within OTP itself — the vulnerability lies in the fact that the code is something a person types, and therefore something they can be manipulated into typing in the wrong place.

Passkeys, also called Security Key MFA, solve this problem entirely.

Passkey MFA allows you to sign in using either:

When you log in, your device creates a unique cryptographic link between your account and our official sign-in page. Critically, this link will only work on the genuine login page — it cannot be replicated or triggered by a fake website. Because there is no code to type, there is nothing to hand over to an attacker, even accidentally.

The secret part of the key never leaves your device. Even if an attacker can see your screen or intercept your network traffic, they cannot obtain or copy it.

Unlike OTP, Passkeys cannot be captured and replayed by a fake website. The authentication is bound to our real login page — it simply will not function anywhere else.

There is no code to read out, enter into a form, or inadvertently share. Login becomes a quick tap or touch rather than a manual process.

Staff spend less time fumbling with phones and authenticator apps. A touch of a key or a fingerprint confirmation is all that is needed.

A physical security key can be shared across a team at a workstation without requiring individuals to have their own mobile device to hand — ideal for hotel front desk and back office settings.

Account compromise via phishing is one of the most common causes of data breaches in hospitality. Passkeys remove the primary attack vector.

The process is straightforward and can be completed in a few minutes per user.

You have two options:

As users are already enrolled in OTP, the existing MFA method must be cleared before a new one can be set up. An admin user, with user management rights, needs to reset the OTP MFA for the relevant user via the standard MFA reset process in the platform. Once reset, the user will be prompted to enrol in a new MFA method on their next login.

On their next login, the user will be prompted to choose an MFA method. They should select Passkey Key.

Your admin can reset the user’s MFA following the same process as Step 2. The user will then be prompted to enrol a new key or device on their next login.

Yes. You can migrate users individually, so there is no requirement to switch everyone at once. We recommend prioritising users with admin or elevated privileges first.

Passkeys can actually replace the need for Trusted Browsers in many scenarios, as a shared physical security key at a workstation achieves a similar outcome while providing stronger security. If you currently rely on Trusted Browsers, speak to us about whether passkeys might be a better fit.