Altitude is passwordless. You sign in with a one-time code sent to your email or with Google, and every payment is secured with two factors: an email code and one of your passkeys.
What is a passkey?
A passkey is a pair of cryptographic keys that replaces a password. Your device, password manager or security key stores the private key. Altitude never receives it. Depending on your provider, your passkey may securely sync across your devices. You unlock it with something you already use, like Touch ID, Face ID or your device PIN.
Passkeys are an industry standard (WebAuthn/FIDO2) built into modern devices and browsers, so there's nothing new to install.
How passkeys differ from passwords:
Nothing to remember or reuse. There is no password to create, type or recycle across sites.
Nothing to leak in a breach. Altitude never stores a password that could be stolen or phished.
Phishing-resistant. A passkey is tied to Altitude's real domain and won't work on a lookalike site.
Unlocked by you. Your biometrics or device PIN approve each use.
Why Altitude uses passkeys
Your Altitude workspace holds real funds and is self-custodial, so account security matters. Passkeys give you strong, phishing-resistant protection without the weak link that passwords create.
Passkeys are one layer of Altitude's enterprise security model, which protects each personal account with three credentials:
Passkeys. Up to 10 passkeys or security keys, used with your primary email to approve payments and other sensitive actions.
Primary email (2FA). Receives your sign-in codes and the codes that confirm payments and other sensitive actions.
Recovery email. A backup on a different domain. Together with your primary email, it confirms adding or replacing a passkey.
Together these protect against a single point of failure. A passkey can't approve anything on its own, so a lost or stolen key isn't enough to move funds.
Where you use your passkeys
Payment approvals, transaction signing and other sensitive actions, such as removing a member, are protected by two factors: verification through your primary email and one of your passkeys. Any passkey on your account works, so use whichever one is with you.
Signed in with Google? When you first approve a payment, Altitude asks for both an email code and one of your passkeys to open your authentication session.
You don't need a passkey to sign in. See Sign in to Altitude.
Your authentication session
After you authenticate with both your primary email code and a passkey, Altitude opens a 30-minute session. You don't need to repeat that authentication for each action during the session.
Set up your first passkey
Some signup flows let you enter Altitude before creating a passkey. Complete account security setup from your dashboard to create your first passkey and verify your recovery email. You need to finish this setup before you can authorize payments and other sensitive actions.
Cardholder-only invitations use a separate setup flow and do not require a passkey.
To set up your first passkey:
Choose where to store it: your device, a supported password manager or a security key like a YubiKey.
Confirm with Touch ID, Face ID, your device PIN or your security key.
Add a recovery email on a different domain from your primary email, and enter the code sent to it.
See Open an account for the full signup walkthrough.
Add another passkey
Add a backup passkey so a lost phone, laptop or security key never stops you from approving payments. You can have up to 10.
Go to Settings › My account.
Start adding a passkey and follow your device, password manager or security key's prompt to create and save it. Follow any additional prompts to confirm you can use it.
Return to Altitude and complete confirmation with the codes sent to your primary and recovery emails.
The new passkey works as soon as the change completes, and your existing passkeys keep working. Because the codes come from your email, you can add a passkey from any device, even one that doesn't hold your other passkeys.
Keep your backup somewhere separate. A second YubiKey kept in a safe, or a passkey in a different password manager, protects you if your everyday device is lost.
Replace a lost passkey
If you lose a device or security key, replace its passkey. The lost passkey stops working and the new one takes its place.
Go to Settings › My account.
Start a replacement from the menu next to the lost passkey.
Create and save the new passkey on your device, password manager or security key. Follow any additional prompts to confirm you can use it.
Complete the replacement with the codes sent to your primary and recovery emails.
Wait for Altitude to confirm that the replacement is complete. The new passkey replaces only the one you selected; your other passkeys remain on your account.
The old passkey keeps working until the replacement completes. You can replace a passkey even if you have no other passkey with you, or if you already have 10.
Rename or remove a passkey
Open the menu next to a passkey to manage it:
Rename. Change the name shown in your list.
Remove. Stop the passkey from signing. Confirm with the code sent to your primary email and one of your other passkeys.
Your last passkey can't be removed. Replace it instead.
Supported passkey providers
You can store your Altitude passkeys with most major providers. The following are confirmed to work:
Windows Hello isn't supported. If you're on Windows, store your passkeys in a supported password manager (such as 1Password) or on a YubiKey. Avoid saving any Altitude passkey to Windows Hello, even if your browser suggests it.