WebAuthn Security Keys

WebAuthn security keys provide strong protection against phishing and account takeover. They use cryptographic hardware to verify your identity. In Zenovay, security keys and platform authenticators are both registered as passkeys, available on every plan.

What is WebAuthn?

WebAuthn (Web Authentication) is a modern standard for passwordless and multi-factor authentication using:

• Hardware security keys: Physical devices like YubiKey
• Platform authenticators: Built-in systems like Touch ID, Face ID, Windows Hello

Zenovay registers both as passkeys. Whether you use a hardware key or your device's biometrics, the setup flow is the same.

Why WebAuthn is Secure

• Phishing-resistant: Keys verify the website domain
• Cryptographic: Uses public-key cryptography
• No shared secrets: Private keys never leave the device
• Tamper-resistant: Hardware-based security

Security Key Options

Hardware Security Keys

Brand	Models	Features
YubiKey	5 Series, Security Key	USB-A, USB-C, NFC
Google Titan	USB-A, USB-C	Bluetooth option
Thetis	Pro, Bio	Fingerprint models
Feitian	ePass, BioPass	Various form factors
SoloKeys	Solo V2	Open source

Platform Authenticators

Platform	Technology	Requirements
macOS/iOS	Touch ID / Face ID	Apple device with biometrics
Windows	Windows Hello	Windows 10/11 with compatible hardware
Android	Fingerprint/Face	Android 7+ with biometrics
Chrome	Profile-based	Chrome 70+

Setting Up a Hardware Security Key

1. 1

   Get a Security Key

   Purchase a WebAuthn-compatible security key. YubiKey 5 series is recommended.

2. 2

   Go to Security & Access

   Go to Settings → Account → Security (/settings/account/security) in Zenovay.

3. 3

   Add a New Passkey

   On the Passkeys card, click New passkey.

4. 4

   Name It (Optional)

   Give it a recognizable name like "Office YubiKey" or "Backup Key". You can leave this blank.

5. 5

   Insert Your Key

   Insert your security key into a USB port (or have NFC ready on mobile).

6. 6

   Touch the Key

   When your browser prompts, touch the button on your security key to complete enrollment.

7. 7

   Add a Backup Method

   Register a second key, or keep your authenticator app and backup codes ready, so you're never locked out.

Setting Up Touch ID / Face ID

macOS with Touch ID

1. 1

   Ensure Touch ID is Set Up

   Go to System Settings → Touch ID & Password and add a fingerprint.

2. 2

   Use Safari or Chrome

   Use a browser that supports Touch ID authentication.

3. 3

   Add in Zenovay

   Go to Settings → Account → Security, then on the Passkeys card click New passkey.

4. 4

   Authenticate

   When prompted, use Touch ID to register. Name it something like "MacBook Touch ID".

iOS with Face ID

1. 1

   Use Safari

   Open Zenovay in Safari on your iPhone/iPad.

2. 2

   Add a New Passkey

   Go to Settings → Account → Security, then on the Passkeys card click New passkey.

3. 3

   Allow Face ID

   When prompted, allow Face ID or Touch ID.

4. 4

   Verify Identity

   Complete Face ID or Touch ID verification to finish enrollment.

Windows Hello

1. 1

   Set Up Windows Hello

   Go to Windows Settings → Accounts → Sign-in options. Set up fingerprint, face recognition, or PIN.

2. 2

   Use Edge or Chrome

   Open Zenovay in Microsoft Edge or Chrome.

3. 3

   Add a New Passkey

   Go to Settings → Account → Security, then on the Passkeys card click New passkey.

4. 4

   Authenticate with Windows Hello

   Use your configured Windows Hello method to complete enrollment.

Using Security Keys to Log In

Once a passkey is registered, when you sign in:

1. Enter your email and password
2. Your browser prompts for your passkey
3. Insert your key (if not already inserted)
4. Touch the button or use biometrics
5. You're signed in

If you've added a passkey, you can also sign in with the passkey and skip the password entirely.

NFC Security Keys (Mobile)

On compatible Android devices:

1. When prompted, tap your NFC security key to the back of your phone
2. Hold until verified

Managing Multiple Security Keys

We recommend registering multiple passkeys:

Recommended Setup

• Primary key: For daily use
• Backup key: Stored securely at home or office
• Travel key: Smaller form factor for travel

Adding Additional Keys

1. Go to Settings → Account → Security
2. On the Passkeys card, click New passkey
3. Follow the registration process
4. Give each key a unique name

Removing Keys

1. Go to Settings → Account → Security
2. On the Passkeys card, find the key in your list
3. Open the menu next to it and choose Revoke
4. Confirm in the dialog

The Passkeys card shows when each passkey was last used, so you can tell which ones are still active before revoking.

Browser Compatibility

Browser	Support Level	Platform Authenticator
Chrome 67+	Full	Yes
Firefox 60+	Full	Yes
Safari 13+	Full	Yes (Touch ID, Face ID)
Edge 79+	Full	Yes (Windows Hello)

Browser Settings

Ensure your browser allows security keys:

• Chrome: Settings → Privacy → Security → Use security key
• Safari: Security keys work by default
• Firefox: about:config → security.webauth.webauthn enabled

Troubleshooting

Key Not Detected

1. Try a different USB port
2. Check USB hub compatibility (try direct connection)
3. Update browser to latest version
4. Try a different browser
5. Check if the key works on other sites

"Security Key Not Allowed"

• Ensure you're using HTTPS (not HTTP)
• Check your browser supports WebAuthn
• Update your browser
• Try incognito mode

Touch ID / Face ID Not Working

• Ensure biometrics are set up on your device
• Try re-registering the passkey
• Check your browser has permission to use biometrics
• Restart your browser and try again

"This Site Can't Use Your Key"

This can happen if:

• The domain changed (phishing protection working)
• The key was registered on a different domain
• Browser security settings block the key

Security Best Practices

Physical Security

• Store backup keys securely: Safe, safety deposit box, or secure drawer
• Don't leave keys plugged in: Remove when not in use
• Keep track of keys: Know where each one is

Digital Security

• Register multiple keys: At least two for redundancy
• Keep firmware updated: Update security key firmware when available
• Use with a strong password: A passkey is one factor, not a password replacement on its own

Passkeys and Passwordless Sign-In

Zenovay registers your security keys and platform authenticators as passkeys. Once a passkey is enrolled, you can:

• Sign in without entering your password
• Use your device's biometrics or a hardware key to authenticate
• Manage all of your registered passkeys from Settings → Account → Security

Next Steps

• Set up multi-factor authentication for a complete account-security setup
• Review security best practices
• Enforce MFA across your team