Set up a passkey, authenticator app and backup codes in SamBooks
9 min read
A passkey lets you sign in without a password, using your fingerprint or face: here's how to set it up, plus the authenticator app and backup codes.
What this is for
Under Settings → Security you'll find three tools to protect your personal account, and they are quite different from one another:
- the passkey is the only one of the three that actually changes how you sign in today: it replaces email and password with your device's biometric authentication (Touch ID, Windows Hello, Android) or a physical security key. It's phishing-resistant because there's no password to steal in the first place.
- the authenticator app (TOTP) and the backup codes can be set up right now, but today they play no part in signing in at all: you sign in with email and password, or with a passkey, full stop. They will become mandatory from December 31, 2026 — setting them up now means you'll be ready for that deadline instead of scrambling at the last minute.
These are personal settings: they apply to your own user account, not to the company, and no one else can see or manage them on your behalf — not even Sam, as you'll see below.
Before you start
- You need a device with a biometric sensor (Touch ID, Windows Hello, face or fingerprint unlock on Android) or a compatible physical security key, to register a passkey.
- For the authenticator app, you need an app such as Google Authenticator or Authy installed on your phone.
- You're already logged in: all three setups happen under Settings → Security, on your own user profile.
How to do it, step by step
1. Register your first passkey
Go to Settings → Security, in the "Passkey" section, and press "Add passkey." Your browser opens the operating system's native flow: you unlock with your fingerprint, face, or device PIN (or insert your security key), and the passkey is saved. You'll see the message "Passkey registered. Next time, you'll be able to sign in without a password." If you cancel the system prompt (or the device doesn't respond), SamBooks treats it as a cancellation, not an error, and nothing happens.
The passkey appears right away in the list with an automatic label based on the device you used (for example "iPhone," "Mac," "Windows," "Android") and the date you added it. You can't rename it: the label stays whatever was detected automatically at the time of registration.
2. Register more, if you use several devices
Repeat "Add passkey" from every computer or phone you want to sign in from without a password: there's no stated limit on how many passkeys you can keep linked to your account, and each one appears as a separate entry in the list with its own date added and, once you've used it, its last-used date.
3. Sign in with your passkey
On the login page, below the email-and-password form, you'll find the "or" separator and, right underneath, an email field with the "Sign in with passkey" button. Type your email, press the button, and complete the same biometric check you used during registration: if the ceremony succeeds, you're signed in directly, without ever typing a password.
4. Remove a passkey you no longer use
In the passkey list, each entry has a trash-can icon on the right: press it to remove it. Careful: removal is immediate, with no additional confirmation prompt. The confirmation message is "Passkey removed." If you're deleting your only passkey, remember you can still sign in with email and password.
5. Set up the authenticator app (TOTP)
In the "Authenticator app (TOTP)" section, press "Set up authenticator app." A QR code appears for you to scan with your app (Google Authenticator, Authy, or similar), along with the key to enter manually below, if you'd rather not use the camera. Enter the code your app generates at that moment into the "6-digit code" field and press "Confirm." If the code is wrong, you'll see "Invalid code. Try again."; once confirmed, you'll see "Authenticator app set up" and the section will show "Authenticator app active." You can cancel the setup in progress with "Cancel," without saving anything.
You can redo the setup at any time by pressing the same button again (now shown in a secondary style): until you confirm the new 6-digit code, the previous setup stays active; as soon as you confirm, it replaces it.
6. Generate backup codes
In the "Backup codes" section, press "Generate backup codes": 8 single-use codes appear. They're shown only once: the message in red, "Save them now: they won't be shown again. Regenerating them makes the previous codes stop working," is literal — SamBooks only keeps an encrypted fingerprint of the codes, not the codes themselves, so if you close the screen without copying them you won't be able to retrieve them again. Use "Copy all codes" to put them straight into a password manager or somewhere safe.
If you need new ones (you lost them, or already used them), press "Regenerate codes": the old ones stop working the instant the new ones are generated.
What each of the three factors protects today
This is the most important part to understand, because it isn't obvious: today, signing in to SamBooks only happens in two ways — email and password, or a passkey. The authenticator app and the backup codes, even once configured, aren't asked for at any point during login: on the Security page you'll find an explicit notice on both — "Not required at login yet" — with the explanation: "Today you sign in with email and password, or with a passkey: this factor isn't asked for. It will become mandatory from December 31, 2026. You can set it up now."
In practice: setting up the authenticator app or the backup codes right now doesn't ask you for anything extra at each sign-in, and doesn't add a second step after your password. It's preparation for a future requirement, not additional protection active from today. The passkey, on the other hand, works right now — which is why it's the part of this guide most worth acting on first.
If something goes wrong
- I lost the phone with the authenticator app: no problem for everyday access, since login doesn't require it yet — you can keep signing in with email and password, or with a passkey. Once it becomes mandatory, that's when you'll set it up again on a new phone with "Set up authenticator app."
- The 6-digit code keeps coming back invalid: check that your phone's clock is set to sync automatically (TOTP codes depend on the exact time) and that you're reading the most recent code, not one that has already expired.
- I deleted my only passkey by mistake: you can still sign in with email and password from the standard login form; from there, go back to Settings → Security and register a new one.
- I don't remember my password and I don't have a passkey: use the "Forgot your password?" link on the login page.
- Passkey registration stops right away: if your browser or operating system doesn't support biometric authentication or security keys (WebAuthn), the flow won't start; try a different, up-to-date device or browser.
Ask Sam
This is an exception to the general rule: you cannot set up your passkey, authenticator app, or backup codes by asking Sam in chat. These are personal security settings tied to your own login — they require direct interaction with your device (your fingerprint, your face, the camera for the QR code) that no assistant can complete on your behalf. They can only be managed here, under Settings → Security.
Frequently asked questions
How do I turn on two-factor authentication in SamBooks? SamBooks doesn't ask for a second factor after your password yet: you can already set up the authenticator app and backup codes from Settings → Security, but they'll only become part of signing in from December 31, 2026. In the meantime, the passkey is the only thing that genuinely changes how you sign in.
How do I set up Google Authenticator for SamBooks? In Settings → Security, under "Authenticator app (TOTP)," press "Set up authenticator app," scan the QR code with your app, and confirm the 6-digit code it shows you.
I lost the phone with my authenticator app: how do I sign in? You keep signing in normally with email and password, or with a passkey: the authenticator app isn't required to sign in yet. Once you're able to, set it up again on a new phone.
What are backup codes? Eight single-use codes meant as a fallback for when the authenticator app and the passkey become part of mandatory sign-in. They're generated and shown only once: save them somewhere safe right away.
How do I register my fingerprint to sign in? Go to Settings → Security, under "Passkey," and press "Add passkey": your device will ask you to unlock with your fingerprint, face, or PIN to complete the registration.
Can I delete a passkey I no longer use? Yes, from the trash-can icon next to it in the passkey list. Removal is immediate and doesn't ask for confirmation, so make sure you can still sign in (with another passkey, or with email and password) before you do it.
What is a passkey and how does it work? It's an access key tied to your device, unlocked with your fingerprint, face, or PIN instead of a typed password: at login you just enter your email, press "Sign in with passkey," and unlock your device.
Does SamBooks support Windows Hello? Yes: passkey registration uses your operating system's native biometric authentication, so it works with Touch ID on Mac, Windows Hello on PC, and biometric unlock on Android.
How do I regenerate my backup codes? Press "Regenerate codes" in the Backup codes section: the previous codes stop working the moment the new ones are generated.
Is it mandatory to turn on the second factor? Not yet: today you can set up the authenticator app and backup codes, but they aren't required at login. They'll become mandatory from December 31, 2026.
If I have a passkey, will it still ask me for my password? No: the passkey is a complete, alternative way to sign in. With a passkey, you never type your password — not at login, and not afterward.
Where do I see the passkeys registered on my account? Under Settings → Security, in the "Passkey" section: the list shows every passkey with the date it was added and, once used, the date of its last use.