# Sign-in and passkeys

## Passkeys are unavailable

Passkeys need a secure browser context and a normal hostname. A plain-HTTP LAN IP address cannot use the WebAuthn passkey flow.

Use HTTPS at the hostname in `TILECAST_PUBLIC_URL`.

If the public proxy hostname is different from the hostname Tilecast sees internally, configure `TILECAST_WEBAUTHN_RP_ID` and `TILECAST_WEBAUTHN_ORIGINS` together.

A passkey belongs to the site domain where it was created. If that domain changes, remove the old credential and enroll a new passkey on the new hostname.

## An account is stuck at MFA enrollment

If the organization requires MFA for that role, the account can sign in far enough to enroll a factor but cannot use the rest of Studio until enrollment is finished.

Authenticator apps and recovery codes still work when passkeys are unavailable.

## Someone lost every factor

Try recovery in this order:

1. Use an unused recovery code.
2. Have an Owner or Administrator reset MFA for an account they are allowed to manage.
3. If the only Owner is locked out, use the server's break-glass MFA reset command with direct server/database access.

Resetting MFA signs the account out and removes its enrolled factors.

If organization policy still requires MFA, the person will be asked to enroll again at the next sign-in.

Protect database backups. Authenticator-app secrets are sensitive backup data because the server must be able to recover them. Passkeys store public keys instead.

See [Protect Studio accounts](../../administration/sign-in-security/) for setup and policy.