Account security

Your Keylight account runs your licenses and your payments. Whoever signs in can create and revoke keys, change prices, and see your customers’ email addresses. A password on its own is too easy to phish, so every Keylight account signs in with two steps: your password, then something only you have.

Two ways to add a second step

A passkey. Touch ID, Face ID, your phone, your password manager, or a hardware security key. With a passkey you can sign in in one step, without typing your password at all.

Hardware keys like YubiKey are the strongest option: the key has to be plugged in or tapped, so nothing on your computer can copy it. See YubiKey (affiliate link).

An authenticator app. Google Authenticator, 1Password, Authy, or any other app that shows a six-digit code. You scan a QR code once; after that, the app gives you a fresh code each time you sign in.

You can add several of each. A second passkey or app is a good backup if you lose a device.

Setting it up

It takes about a minute. Open Security from your account menu (your name, bottom left of the dashboard), or use Set it up now in the banner at the top of the page.

Adding a passkey needs a recent sign-in. If it has been more than a day, the page asks you to sign in again first.

Your recovery phrase

When you turn on your first passkey or authenticator app, Keylight shows you a recovery phrase: 12 words, shown once. You can copy them or download a recovery kit (a PDF) to print.

Caution

This phrase is the only way back into your account if you lose your devices. Keylight support cannot reset it.

Write it down and keep it somewhere safe, away from your computer. Keylight stores only a one-way fingerprint of it, so nobody at Keylight can read it or send it to you.

You get a phrase when you first turn on two-step sign-in, and a new one each time you recover. Think yours leaked? Use it yourself at app.keylight.dev/signin/recover, set up a passkey or authenticator app again, and you get a new phrase. The old one stops working.

If you lose your devices

Go to app.keylight.dev/signin/recover and sign in with your password and your recovery phrase. Then:

• Every passkey and authenticator app on the account is removed, every other session is signed out, and CLI logins are revoked.
• You set up a new passkey or authenticator app straight away.
• You get a new recovery phrase. The old one stops working.

Keylight emails your account address each time the recovery phrase is used. If you get that email and it wasn’t you, use your phrase yourself right away at the same page and set up a new passkey or authenticator app. That replaces the phrase and locks the other person out.

If you lose your devices and your phrase

Then nobody can get you back into the dashboard or the CLI, including Keylight support. This is on purpose: Keylight doesn’t collect names or ID, so there is nothing to check a request against, and a support-desk reset is exactly what someone impersonating you would ask for.

Your business keeps running regardless. See below.

What keeps working

Two-step sign-in is about people signing in. Nothing that runs your business depends on it:

• Your apps keep activating and checking licenses with your SDK key.
• Purchases through Stripe, Paddle, Lemon Squeezy, Polar and Gumroad keep issuing licenses.
• Your webhooks, your customers’ emails and the customer portal keep working.
• API tokens you created in the dashboard (Settings → API tokens) for your servers and CI keep working.

The Keylight CLI

Signing the CLI in goes through the dashboard, so it uses the same two steps. When you turn on two-step sign-in, CLI logins made before that are signed out. Run this once:

keylight login

If the account has no passkey or authenticator app after the deadline, the CLI stops with:

Two-step sign-in is required on this Keylight account. Set it up at app.keylight.dev, then run `keylight login` again.

The deadline

Accounts that existed before two-step sign-in launched get 30 days to set it up. Until then, sign-in works as before, and the dashboard shows the exact date in a banner at the top of every page.

After the deadline, an account without a passkey or authenticator app can still sign in with its password, but the only page it can open is the setup page. It takes a minute, and everything is back.

Accounts created after launch set it up as part of signup, right after confirming their email.