Account security: passkeys, two-step verification and devices

Open Account. The Security, Devices and Security activity sections are what this page covers.

Passkeys: sign in without typing

A passkey signs you in with your device's own unlock: Face ID or Touch ID on iPhone and Mac, Windows Hello, or your Android screen lock.

1. Go to Account → Security and click Add a passkey.
2. Confirm with your browser (a glance, a fingerprint or your device PIN).
3. Next time, click Sign in with a passkey on the sign-in page. No email needed.

• Passkeys sync with your Apple, Google or Microsoft account, so they move to your new phone too.
• The Android app, iOS app, desktop app and browser extension open your system browser to sign in, so your passkeys work there as well.
• Signing in with a passkey already counts as two-step verification, so we won't ask for a code.

Two-step verification

When it's on, after you sign in with an email code, Google or Notion, we also ask for the 6-digit code from an authenticator app (Google Authenticator, 1Password, Microsoft Authenticator and others).

1. Account → Security → Two-step verification → Set up.
2. Scan the QR code with your authenticator app (or enter the key by hand).
3. Enter the 6-digit code and click Turn on.
4. Save your 10 recovery codes. If you lose your phone, each one finishes two-step verification once.

Too many wrong codes lock the second step for 15 minutes. Turning off two-step verification, getting new recovery codes, removing a passkey, creating an API token and changing your email are sensitive, so we ask you to confirm it's you first.

This is two-step verification for your WidgetStore account itself. We don't store or sync your two-step codes for other websites.

Your devices

Account → Devices lists everywhere you're signed in: browsers, the phone apps, the desktop app and browser extensions.

• Sign out ends that device's session right away. Apps and extensions need to reconnect.
• Sign out everywhere else: if you think someone else is using your account, do this first, then turn on two-step verification.
• Devices you haven't used for 30 days are signed out automatically.
• We only show the country, never IP addresses.

How many devices at once

Device	Free	Pro
Browsers	3	10
Phones (Android / iOS app)	2	5
Desktop app	2	5
Browser extensions	2	5

When a type is full, we show those devices and you choose one to sign out before continuing. We never sign another device out behind your back. Web pages inside the apps or the extension don't use an extra slot.

Security activity and email alerts

Account → Security activity shows recent sign-ins and security changes. We also email your verified address when a new device signs in, two-step verification is turned on or off, a passkey is added or removed, a recovery code is used, or account deletion is requested. If you get an alert you don't recognize, sign out of all other devices and turn on two-step verification right away.

Deleting your account

In Account → Data & account you can export your data or request deletion. We check every request by hand and finish within 7 days. Reply to the confirmation email to cancel.