Open Account Settings and choose the relevant tab. Keep a working alternative sign-in method before removing a passkey or linked provider. An API key cannot recover dashboard access.

Passkeys

  1. Open Passkeys, enter a recognizable Passkey label, and choose Add Passkey.
  2. Complete your browser's prompt using a fingerprint, face, device PIN, or compatible security key. Check that the key appears under Registered Passkeys.
  3. To sign in, enter your account email on the login page and choose the passkey option.

Another device: choose another device or phone in the browser prompt, if offered. Availability depends on your browser and passkey provider. Alternatively, sign in on the other device with an existing method and add a passkey there. Passkeys may sync through your provider; check before relying on another device.

Remove or recover: choose Delete beside a key to stop it signing in. Deleting the last passkey is blocked if no password or linked SSO account remains. If a device is lost, sign in with another passkey, your password (if configured), or linked SSO; delete the lost key and add a replacement. Complete 2FA if prompted. For a forgotten password, use Forgot Password; 2FA still applies. If you cannot sign in, contact support.

Under Passkey Sign-In Policy, select an option and choose Save Policy:

  • Skip TOTP after user verification: a verified passkey completes sign-in without a separate authenticator code.
  • Still require my TOTP code: passkey sign-in also asks for a code when 2FA is enabled and confirmed. This setting does not enable 2FA itself.

The policy applies to all your passkeys. Skipping TOTP leaves 2FA enabled for password and SSO sign-in.

SSO

  1. Sign in to your existing X4B account and open Single Sign On.
  2. Under Add Service, choose Link with Google, Link with Facebook, or Link with Yahoo. Sign in to the intended provider account and confirm the link.
  3. Check the linked account in this tab. A provider identity assigned to another X4B account cannot be linked here.

To unlink, use Action → Delete; that provider account can no longer sign in to X4B. Unlinking the last SSO account is blocked if no password or passkey remains. Keep and test a password, passkey, or another linked provider first. If you lose provider access, use that alternative to sign in and unlink it. Recover provider access through the provider; contact X4B support if you cannot access X4B.

Two-factor authentication

  1. Open Two-Factor Authentication and choose Enable 2FA.
  2. Scan the QR code with an authenticator app. Store the displayed Recovery Code in a password manager or another secure location accessible without that device.
  3. Enter the app's current six-digit code and choose Confirm & Activate 2FA. Protection starts after confirmation.

Use the recovery code: sign in with your password, SSO, or passkey. At the 2FA prompt, enter the full recovery code in Code. X4B provides one reusable recovery code, not a list of single-use codes. Keep it secret; it remains valid until 2FA is reset or removed.

Replace a device: while you can sign in, transfer your authenticator through the app, or choose Reset 2FA and enroll the new device. Reset immediately replaces the old secret and recovery code and leaves 2FA inactive until you confirm the new code. Finish setup, save the new recovery code, and discard the old details. Remove 2FA turns protection off and invalidates those details.

Lost device: use your saved recovery code, a transferred authenticator, or a passkey configured to skip TOTP, then reset 2FA. If none is available, contact support; restoring access requires identity verification. A password reset alone does not remove 2FA.

API keys

  1. Open API Keys, enter a descriptive Name under New Key, and choose Create Key. Use a separate key for each integration.
  2. Copy the key immediately into a password manager or secrets store. It is displayed once; refreshing or revisiting the result cannot reveal it again. Keep it out of source control, screenshots, and shared messages.
  3. To revoke access, use the key's Action → Delete. Requests using that key will fail; update or stop any integration that depends on it.
  4. To rotate, create and securely save a replacement, update the integration, verify it works, then delete the old key. If a key is exposed, revoke it immediately. If you missed its one-time display or lost it, delete it and create another.

See Public API documentation for authentication and usage details.