Passkeys

Your passkey is your zk.money account. This page explains the two keys it gives you, which passkeys work, how to reach yours from each device, and what to do when something goes wrong.

Your two keys

Your passkey gives zk.money two keys: one for your funds and one for your privacy.

• Signing key. Approves every payment. It is the passkey's own key, and it never leaves your passkey. Your account accepts only this key, and it is built into your account's address.
• Secret key. Reads your balance and your payment history. Your passkey makes it with the WebAuthn PRF extension, which gives a secret value that only this passkey can produce. zk.money keeps it in your browser until you sign out; see Trust model for what that means.

Which passkeys work

zk.money works with a passkey saved in:

• iCloud Keychain (Apple Passwords)
• Google Password Manager
• 1Password
• a YubiKey 5 security key

It refuses other passkey managers, such as Bitwarden, Proton Pass, LastPass or Windows Hello. zk.money has not tested that they give the same secret key on every device, and a secret key that changes would lock you out of your wallet.

A password manager syncs your passkey to your other devices, and that sync is your backup. A security key holds the only copy: lose the key and you lose the wallet.

Reaching your passkey

On a phone, use the passkey saved on that phone, or a security key. Plug the key in, or hold it to the phone, only after the browser asks for it. A key that is already plugged in may not be found.

On a computer, at sign-up, zk.money asks Where should your passkey live? and lists the places this browser can use. Pick one, then choose Continue:

• 1Password, shown when the 1Password browser extension is recognized and the browser can use 1Password.
• This computer (This Mac on a Mac), a password manager on the computer itself where zk.money knows it reads the passkey right: Google Password Manager in Chrome (on Windows, a Mac or Linux, signed in to your Google account), or Apple Passwords on a Mac on macOS 15 or later, in Chrome, Edge, Brave, Safari 26.4 or later or Firefox 153 or later. On a Mac where the sheet shows no 1Password option, it also names 1Password: the Mac asks where to save the passkey, and the 1Password app can take it there. If a password manager's extension pops up, dismiss it and use the browser's own prompt.
• Your phone: the browser shows a QR code. Scan it with your phone to save the passkey there.
• Security key: a YubiKey 5 you plug in or tap. Open About security keys under it first: the key keeps the only copy of your passkey.

While the passkey is being created, whichever option you picked, a red line above the button or spinner asks you to close a browser extension's own pop-up if one opens and to use the native passkey prompt. It shows when the sheet has recognized an extension zk.money cannot use.

Safari and Firefox can't be asked to open their prompt on a phone or on a security key, so there the two are one option, Your phone or a security key, and you pick the device in the browser's prompt. In Firefox on Windows, choose "iPhone, iPad or Android device" for your phone, or "Security key", not Windows Hello.

1Password works on the computer through its browser extension: on Windows or Linux in Chrome, Edge, Brave or another Chromium browser, and on a Mac in Chrome, Edge, Brave or Safari 26.4 or later (see 1Password on a computer: use the browser extension). On Windows or Linux, in a browser where 1Password's extension works for zk.money, the sheet asks you to install it and reload the page when no extension answers. With another manager's extension, Chrome still offers This computer with Google Password Manager; Edge, Brave and other Chromium browsers offer your phone or a security key. On a Mac the 1Password app can also save the passkey as the Mac's passkey provider: choose This Mac, then pick 1Password when the Mac asks where to save it. In Firefox 153 or later that is the way, and if the Mac doesn't offer 1Password, use your phone. In the other Mac browsers, with the 1Password extension recognized, you can choose 1Password instead. Other browsers and other Macs use the phone or a key. On macOS 15 or later, updating an older Safari or Firefox may let you save the passkey on the Mac with no QR code.

On a computer, at sign-in, the browser offers whatever it can reach:

• a copy of your passkey on this computer: iCloud Keychain on a Mac, Google Password Manager in a Chrome signed in to the same Google account, the 1Password browser extension, or the 1Password app as the Mac's passkey provider
• your phone, through the QR code
• a security key

For zk.money Desktop, see How to run the desktop app.

Problems at sign-up

When zk.money refuses a passkey at sign-up, the passkey may already have been saved. See A passkey is left over before you try again.

"That passkey provider isn't supported"

The passkey was saved in a manager zk.money does not accept. Pick one from Which passkeys work and sign up again.

Bitwarden's browser extension answers every passkey request on a computer, whatever you pick, so the message says how to keep it out: in the extension's settings, add the site's address the message names (for example wallet.zk.money) to Bitwarden's excluded domains, then sign up again. The browser's own prompt then opens instead.

"Use your phone or a security key"

You picked your phone or a security key, and the passkey was saved on the computer instead, often by a password manager's browser extension. Sign up again, pick Your phone or Security key (Your phone or a security key in Safari and Firefox), and dismiss any password manager that pops up on the computer. Where the sheet offers This computer or 1Password, you can pick that instead. On Windows or Linux you can also sign up in Google Chrome, which can save the passkey on the computer in Google Password Manager. If Bitwarden saved it, see "That passkey provider isn't supported" for how to keep it out.

"Save the passkey somewhere else"

You picked This computer, This Mac or 1Password, but the manager that took the passkey can't hold a wallet's passkey here: Apple Passwords on a Mac on macOS 14 or earlier, which gives no secret key at all (update macOS to use it); or a manager the browser didn't name, which is how some password managers' browser extensions answer. Sign up again and pick one of the managers the card names, dismissing any other password manager's pop-up, or choose Use my phone, which brings the sheet back with your phone picked. The passkey that was saved stays in that manager; see A passkey is left over.

"This passkey can't be backed up"

The passkey was saved somewhere that keeps it on one device only, so losing that device would lose the wallet. Use a password manager that syncs, or a security key.

"Try a different passkey manager"

Your passkey manager did not give zk.money your secret key. Use another one from Which passkeys work.

"This device can't use that security key"

The security key gave no secret key on this device. Known causes: an iPhone older than iOS 26.4, a YubiKey Bio, or an Android phone with out-of-date Google Play services. Update the device, or use a YubiKey 5 on another device.

"Update this browser, or use Chrome"

On a Mac, signing up needs Safari 26 or later, or Firefox 139 or later. Older versions can still sign in. Safari 26.4 or later and Firefox 153 or later can also save the passkey on the Mac with no QR code: in Apple Passwords on macOS 15 or later, or in 1Password. Safari updates apart from macOS, in System Settings > General > Software Update. Or sign up in Chrome, or on your phone. On an iPhone, zk.money needs iOS 18.4 or later, and shows a warning on older versions. Update iOS in Settings, or use another device.

A passkey is left over

A website cannot reliably delete a passkey, so a refused sign-up usually leaves one behind. The passkey from the refused attempt opens nothing and is safe to delete. It is saved wherever the prompt that answered saved it: the phone you scanned with, the security key you used, or this computer when the message said a manager on this computer saved it. If you are not sure one was saved, check there.

Look for auth.zk.money in the list; some managers show it as zk.money. The leftover is the entry made at the time of the refused sign-up. If you signed up successfully after it, the entry from that later sign-up is your wallet's passkey: keep it, and keep any zk.money passkey you sign in with. Delete an entry only when you are sure it came from the refused attempt; if you cannot tell them apart, leave both. A spare entry only clutters the list, while deleting the wrong one loses the wallet. Deleting the leftover before you sign up again keeps the browser's list to the passkey that works.

• Apple Passwords. On an iPhone or iPad, open the Passwords app, tap Passkeys, tap the entry, tap Edit, then Delete Passkey. On iOS 17, it is under Settings > Passwords. On a Mac, open the Passwords app, click All, select the entry, click Edit, then Delete Passkey. On macOS 14, it is under System Settings > Passwords.
• Google Password Manager. On an Android phone, open Chrome, tap ⋮ > Settings > Google Password Manager > Passkeys, tap the entry, then Delete. On an iPhone or iPad, the list is in Chrome under ⋯ > Password Manager. On a computer, open Chrome, choose ⋮ > Passwords and autofill > Google Password Manager, open the entry and choose Delete.
• 1Password. In the 1Password app or browser extension, open the item, choose Edit, remove the passkey field, then Save. If the item holds nothing else, delete the item.
• Bitwarden. In the web app, browser extension or desktop app, open the item, choose Edit, select the delete icon beside the Passkey field, confirm, then Save.
• Windows Hello. On Windows 11, open Settings > Accounts > Passkeys, then … > Delete passkey beside the entry.
• A security key. For a YubiKey, open Yubico Authenticator on a computer or an Android phone (the iPhone version has no passkey list), choose Passkeys, unlock with the key's PIN, open the entry and choose Delete passkey. For another maker's key, use that maker's app to delete the one passkey; a key's "reset" wipes every passkey on it.
• Another passkey manager. Open its list of passkeys or logins, search for auth.zk.money, and delete that entry.

Problems at sign-in

The browser does not offer your passkey, or says "Passkey not on this device"

A browser can only offer a passkey it can reach. If yours is on your phone, choose the QR code option and scan it with the phone. Turn on Bluetooth on both devices and keep both online. If no QR code appears, look for "More options" or "Use a different device". Closing the QR window instead makes zk.money say "Passkey not on this device".

On a Mac, Chrome can use iCloud Keychain only if you allow it in System Settings > Privacy & Security > Passkeys Access for Web Browsers.

If no option appears at all, update your browser.

Your Google Password Manager passkey does not appear

A passkey in Google Password Manager belongs to the Google account it was saved under, often the one on your phone. Chrome on a computer offers it only when that Chrome is signed in to the same Google account. If you use a sync passphrase, Chrome needs it first, and it may ask for your Google Password Manager PIN or your Android screen lock the first time. A passkey you just made can take a few minutes to reach the computer. Scanning the QR code with your phone may also need a Chrome signed in to that account.

iCloud Keychain passkeys do not depend on Google.

1Password on a computer: use the browser extension

On a computer, 1Password gives zk.money your secret key through its browser extension. On a Mac the 1Password app can answer too, as the Mac's passkey provider (System Settings > General > AutoFill & Passwords), and it gives the key there as well. On Windows the 1Password app can also answer, in the Windows passkey window, and there it gives none: zk.money shows "Try a different passkey manager". Sign in or sign up again and use the extension's pop-up instead. If you don't have the extension, install it or turn it on and reload the page, or choose the QR code option and use the 1Password app on your phone.

Your Mac's passkey does not open your wallet

On macOS 15 before 15.7.5, and on macOS 26.0 to 26.3, a Mac's copy of a passkey made on an iPhone can give the wrong secret key. This is an Apple bug. Macs updated to 15.7.5 or a later macOS 15, or to 26.4.1 or later, read it right in our tests; 26.4.0 was not tested, and the macOS 15 result rests on a small number of Macs. A passkey made on the Mac itself has read right in every test. zk.money refuses the wrong secret key, so nothing is lost, and may say "This computer is returning the wrong key". Choose Use my phone and scan the QR code with your iPhone. After that you stay signed in until you sign out or this browser clears its data (Safari clears a site's data after about a week without a visit). Updating macOS is worth a try: later versions fixed this on the Macs we tested. To use a security key or another passkey, choose Show passkeys, or Use a different passkey on the unlock screen.

"No wallet for this passkey"

The passkey you used did not open a wallet zk.money can find.

• You may have picked a different passkey. Choose Show passkeys and pick another, or type your tag on the sign-in screen so zk.money asks for the passkey that tag uses.
• On a Mac, this computer's copy of your passkey may be giving the wrong secret key (see Your Mac's passkey does not open your wallet). Choose Use my phone, and updating macOS is worth a try.
• Until your tag is active, a different browser may not find your wallet. Sign in on the browser you signed up on.
• A passkey left by a refused sign-up opens nothing. Choose Show passkeys and pick another, and see A passkey is left over to delete it.

"Passkeys unavailable on this site"

Your passkey belongs to auth.zk.money, which lists the zk.money sites allowed to use it. This message means the browser refused the passkey request on this site, on the website or in zk.money Desktop.

• If the message says zk.money needs iOS 18.4 or later, update iOS in Settings, or use another device.
• Otherwise, a password manager's browser extension may have blocked the request. Turn off the extension's passkey option for this site, or use another browser. If the message names Bitwarden, add the address it gives to Bitwarden's excluded domains. An out-of-date browser can also refuse, so update it. If it still fails, contact support.