Account & Security

Security Keys

Phishing-resistant, passwordless authentication via WebAuthn / FIDO2.

Supported Authenticator Types

Type	Examples
Hardware security keys	YubiKey, Google Titan Key, SoloKeys, Feitian
Platform authenticators	Windows Hello, Touch ID, Face ID, Android fingerprint
Passkey managers	1Password, Bitwarden, Apple Passkeys, Google Password Manager

Register a Security Key

1. Click Add Security Key.
2. Enter a descriptive name (e.g. YubiKey 5 or MacBook Touch ID).
3. Click Register and follow the browser prompt (fingerprint, face scan, PIN, or hardware key).

The server only stores the public key credential — biometric data never leaves your device.

Security Keys Table

Column	Description
Name	The label you gave at registration
Added	Date the key was registered
Last Used	Date it was most recently used to log in
Actions	Delete button to remove the key

Remove a Security Key

Click the delete icon next to a key and confirm.

Keep At Least One Authentication Method

If you remove all security keys and forget your password, you will be locked out. Always keep at least one valid method, or have another admin account available to reset your password.

---

Authorizers

Admin user accounts that can log into the Woho admin panel.

User Table Columns

Column	Description
Username	Login name used to sign in
Full Name	Optional display name
Email	Optional email address
Status	Active (can log in) or Inactive (blocked)
Last Login	Timestamp of the most recent successful login
Actions	Edit (pencil) and Delete (trash) buttons

Create a User

1. Click New User.
2. Fill in the username (required), password (required), and optionally full name and email.
3. Click Create.

Edit a User

Click the pencil icon next to any user to change their username, full name, email, or password.

Delete a User

Click the trash icon next to a user and confirm. This permanently removes the account and all associated activity history.

Caution

Deleted users cannot be recovered. To temporarily block access without losing the record, edit the user and set their status to Inactive instead.

---

WebAuthn Requirements

Security keys require a secure context (HTTPS). For production:

• Access the server over HTTPS
• Set -rpid to the domain in the browser address bar
• Set -rporigin to the full https:// origin URL

See Server Configuration for details.