Passkey sign-in and recovery code fixes
Accounts with only a passkey can verify with it, passkeys without a PIN now work, enrolling a factor issues recovery codes, and a sign-in loop is fixed.
A set of fixes for two-factor sign-in:
- Passkey-only accounts can sign in. The verification page offered only a six-digit code or a recovery code, so accounts whose only second factor was a passkey were locked out. The page now offers each method the account has, and starts with the passkey when there is no authenticator app.
- Passkeys without a PIN or biometric work. Security keys without a PIN, and some phone and Windows set-ups, passed in the browser and then failed on the server. They now register and verify.
- Recovery codes on enrollment. Recovery codes used to come only from a manual button, so most accounts had none. Enrolling a first factor now issues a set, shown once. Settings warns if you have a factor but no codes.
- No more sign-in loop. When an MFA check was due, sign-in could loop back to the login page forever. It now goes to the MFA step.
If you still can't sign in, see troubleshooting.