# Approvals and passkeys

> Your approval passkey, which actions need it, approving from the panel, and adding a second device.

## The approval passkey

When you create your account, Zefily asks you to register an **approval passkey** — a passkey on your phone, laptop or security key. It is held by Zefily's separate signing service, not by the panel, so even someone with your panel session cannot approve risky actions without your device.

Manage it under **Settings → Approvals**:

- **Register approval passkey**: the first one is registered directly, and you get an email when it is added.
- **Add another approval passkey**: keep a second one on another device so losing one does not lock you out. Your current passkey approves the new one first (up to five).

## What needs approval

| Action | Where |
| --- | --- |
| Root terminal, or a sudo user's | Terminal |
| Commands, cron entries, daemons and saved scripts that run as root or a sudo user | Cron, Daemons, Scripts |
| Rebooting a server | Reboot |
| Opening a database or cache port to everyone | Firewall |
| SSH keys, sudo and deleting server users | Users |
| Deleting a site with its files, a database, or restoring a backup | Sites, Databases, Backups |
| Importing a database dump | Databases |
| Switching the web server | Web stack |
| Custom nginx directives | Site → nginx |
| Removing the agent | Overview |

## Approving

When an action needs approval, the panel shows **Approve with passkey** next to it (and on the server's **Activity**). Click it and confirm on your device; the job then runs. Approvals are tied to that one job on that one server and expire after a short time.

Each approval is emailed to you from the signing service. If you get an approval email you did not expect, change your password and passkeys and [contact support](/support).

## Recovery codes

When you create your first approval passkey you get **10 recovery codes**, shown once: copy or download them and keep them apart from your devices. Each code works one time. **Settings → Approvals** shows how many are left; **Create new recovery codes** (confirmed with your passkey) replaces them all.

Passkeys saved in iCloud Keychain or Google Password Manager move with you to a new phone or computer, and you can add a second device under **Add another passkey** — the easiest way never to need recovery.

## Losing your passkey

Open **Settings → Approvals → Lost your approval passkey?**:

- **With a recovery code** — enter it and register your new passkey. It works at once and replaces the old ones; you get a fresh set of codes.
- **Without a code** — choose **Email me a confirmation link** and open the link (valid for 30 minutes). Register your new passkey right away; it starts approving **one hour** later. Until then your old passkeys keep working and can **cancel** the recovery.

Every step is emailed to you from Zefily's signing service, separately from the panel. If you get such an email and did not start a recovery, sign in and cancel it with one of your passkeys. Nobody at Zefily can reset an approval passkey by hand: this is what keeps your servers safe even if someone got into your account.

---
Source: https://zefily.com/docs/approvals