Signing In With a Security Key
Protect your account with a physical key you tap. Register two, keep one safe, and nobody gets in without one of them.
🔐 What a Security Key Does
A security key is a small device, such as a YubiKey, that proves it is really you signing in. After you enter your password, your browser asks you to tap the key. Only that physical key can answer, so knowing your password is no longer enough for someone to reach your mail.
This is stronger than a code from an authenticator app. A code can be typed into a convincing fake login page and reused by whoever is running it. A security key checks the web address itself before it responds, so it simply will not answer a copycat site. That property is why security keys are the recommended second factor for accounts that matter.
CodaMail supports any FIDO2 key, including YubiKey, SoloKeys, Google Titan and Feitian, as well as the unlock built into your own computer or phone.
📋 Why We Ask for Two Keys
Before you can switch this on, CodaMail asks you to register two keys. This is deliberate, and it is the single most important thing to understand about the feature.
A security key is a physical object. Objects get lost, left in hotel rooms and put through washing machines. If your only key disappears and it is the sole way into your account, you have a serious problem. A second key, kept somewhere safe and separate, turns that disaster into an inconvenience. Either key signs you in on its own.
At least one of your keys must be a separate device rather than your computer’s built-in unlock. A key on a keyring works on any machine and survives replacing your laptop. A built-in fingerprint or face unlock is convenient day to day, but it exists only on that one device and disappears with it.
💡 The usual arrangement: one key that lives on your keyring or in your laptop bag, and a second key stored somewhere safe at home. Many people add their phone or laptop unlock as a third, purely for convenience.
⚙️ Setting It Up
Go to Settings, then Security Keys, and choose Set up security keys. The setup runs in three steps.
Step one, your main key. Give it a name you will recognise later, such as “Desk key” or “Keyring”. Insert the key and tap it when your browser asks. Naming keys matters once you have more than one, because the names are how you tell them apart when removing or replacing one.
Step two, your backup. You choose what kind of backup to add. Another security key is recommended, and is what most people should pick. This device uses Touch ID, Windows Hello or your phone’s unlock instead, which is convenient but only works on that one device. Name it and tap it the same way.
Step three, turn it on. Once both keys are registered, confirm to switch security-key sign-in on. Nothing changes until you do.
You can add more keys later from the same page. If security-key sign-in is already on, you will be asked to tap an existing key first, which stops anyone who happens to be sitting at your unlocked screen from quietly adding one of their own.
🔑 Signing In
Enter your username and password as usual. You will then see a page asking you to insert your security key and tap it. Do that, and your mailbox opens.
Either of your keys works. There is no primary and secondary at sign-in time, so whichever one you have with you is the one to use. If a tap does not register, the page offers a Try again button, and you can sign out from there if you picked the wrong account.
Until you tap a key, nothing else in your account opens. Bookmarks and links into your mail all lead back to the same prompt.
🛠️ Managing Your Keys
The Security Keys page lists every key you have registered, with its name, the model where we can identify it, whether it is a separate key or a built-in one, when you registered it and when you last used it.
From here you can rename a key, remove one you no longer have, and unlock one that has been locked. Removing a key, turning the feature off, or adding a key while it is on all require a tap of a working key first.
You will not be allowed to remove a key if doing so would leave you below two keys, or would leave you without any separate security key. If you genuinely want to go back to password-only sign-in, turn the feature off first, then remove the keys.
If a key has never been used after a few months, the page will suggest signing in with it once. This is worth doing. A backup you have never tested is a backup you are only assuming works.
🇾️ The Recovery Key
While this feature is in beta, you can generate a recovery key: a one-time code you keep somewhere safe. It is shown once, when you create it, and cannot be retrieved afterwards.
The recovery key never signs you in. It exists for one purpose, so that our support team can reset your security keys if something goes wrong and you cannot use any of them. You hand it to support, they verify who you are, and they clear your keys so you can start again.
⚠️ Save it carefully. The recovery key is shown a single time and we cannot recover it for you. If you lose it, or turn it off, and your keys later stop working, support has no way to reset them and you could permanently lose access to your account.
You can turn the recovery key off at any time from the Security Keys page, and generate a fresh one whenever you like. Generating a new one replaces the old one immediately.
🔧 If You Lose a Key
You still have your other key. This is exactly what it is for. Sign in with it, remove the lost key from the list so it can no longer be used, and register a replacement so you are back to two.
You have lost all of your keys. Contact support. If you generated a recovery key, have it ready. We will verify your identity and reset your security keys, after which you sign in with your password and set up new keys. If you never generated a recovery key, we will need to verify your identity another way before we can help, so expect that conversation to take longer.
A key shows as locked. A key locks itself when it behaves in a way that suggests it may have been copied. Sign in with your other key and unlock it from the Security Keys page. If the same key keeps locking, stop using it, remove it and register a replacement.
📱 What Works Where
Security keys work in current versions of Firefox, Chrome, Edge and Safari, on desktop and mobile. If your browser does not support them, the page will tell you plainly rather than failing silently.
A key with an NFC antenna, such as the YubiKey 5 NFC, can be tapped against the back of a phone to sign in there. This is the neatest way to cover both your computer and your phone with the same pair of keys.
Your phone’s own unlock, added as “This device”, signs you in on that phone. It is not a way to approve a sign-in happening on your computer. If you want to sign in on a computer, use one of your separate keys.
Security keys need a browser that can talk to the key, so they cannot be used in our text-only mode. If you rely on text mode, either sign in with a graphical browser or leave security keys switched off.
🛡️ Choosing Between Security Keys and an Authenticator App
CodaMail offers two kinds of second factor, and you can have one of them active at a time. If you try to switch on security keys while the authenticator app option is on, we will ask you to turn that off first, and the same applies in reverse.
Security keys are the stronger option, because a key refuses to answer a fake site while a typed code does not. They also need no phone, no battery and no clock. The tradeoff is that you are carrying a physical object, and you should own two of them.
An authenticator app is the better choice if you would rather not buy hardware, or if you need to sign in from places where plugging in a key is impractical. It is a genuine improvement over a password alone.
If you are unsure, start with the authenticator app. You can move to security keys later without losing anything.
📞 Need Help?
If you have questions about security keys, or you cannot sign in, contact our support team at helpdesk@codamail.com. If you have a recovery key saved, mention it when you write in, as it lets us help you considerably faster.