Protect your account with Google and passkeys

Fiscalapi lets you sign in to the dashboard with your email and password, with your Google account, or with a passkey, and protect your account with two-step verification. Everything is optional, and your current way of signing in keeps working.

Sign in with Google

On the sign-in page and on Sign up, click Continue with Google. Google confirms your identity, and Fiscalapi never sees your Google password. The result depends on your account:

• If the email has no account in Fiscalapi, we create your account and you sign in.
• If you already have your own account with that confirmed email, we link it to Google and you sign in. We send you an alert email.
• If your organization's administrator created your account, or your email isn't confirmed, Fiscalapi doesn't link it on its own. Sign in with your password, then link Google from Profile > Security.

To unlink Google, go to Profile > Security and click Unlink. If your account has only Google, you can Create password in Profile. We send a 6-digit code to your email.

What is a passkey

A passkey is a credential from the FIDO2/WebAuthn standard. It lives on your device or in your password manager, such as iCloud Keychain, Google Password Manager, or 1Password, and you unlock it with your fingerprint, your face, or your device PIN. There's nothing to remember, and a fake site can't steal it: it works only with Fiscalapi. A synced passkey survives losing your device.

Create and use a passkey

Create one in Profile > Security > Create passkey, or from the invitation that appears after you sign in with a password or Google. To sign in, use Sign in with a passkey on the sign-in page, or choose your passkey in the email field when the browser offers it. You can have up to 10 passkeys, and you can delete them from the same section.

Two-step verification

Turn it on in Profile > Security > Enable. It uses your passkey as the second step: after your password or Google, Fiscalapi asks you to confirm it's you with your passkey. When you enable it, you receive 10 recovery codes. Each code works only once to sign in when you don't have your passkey with you, through Use a recovery code.

You can Generate new ones (the previous codes stop working) or Disable two-step verification.

Don't lose access

• Create at least two passkeys, or one synced passkey.
• Save your recovery codes outside your device: download them or copy them when you enable two-step verification.
• Keep your password or your Google account as another way to sign in.
• For security, changing these options requires that you signed in recently. If we ask, sign in again.
• We send you an email when a passkey is added, when two-step verification is enabled or disabled, when new codes are generated, or when Google is linked. If it wasn't you, change your password and contact support.
• If you lost your passkeys and your codes, contact support. After we verify your identity, we can reset two-step verification.