Passkeys and two-factor authentication
Add passkeys, set up TOTP, store recovery codes.
Two ways to make your Dalea account substantially harder to compromise: passkeys (the recommended default) and two-factor authentication via TOTP (useful when you sign in with email-and-password).
Why bother
Lab accounts are valuable targets — they grant access to compounds, animal welfare data, and IP. The threat model isn't sophisticated nation-state actors, it's commodity phishing kits and password reuse. Both passkeys and TOTP defeat those.
Passkeys (recommended)
A passkey is a public/private key pair stored on your device's secure keychain. Signing in is biometric (Touch ID, Face ID, Windows Hello, your phone's fingerprint sensor) — there's no password to phish or to forget.
Modern OS keychains sync passkeys across your devices: a passkey added on a Mac shows up on your iPhone via iCloud Keychain; on Android via Google Password Manager; on Windows via Microsoft account.
Adding a passkey
- Settings → Security → Passkeys
Click Add passkey.
- Name it (optional)
"MacBook Pro" or "iPhone" makes the list readable later. You can rename it afterwards.
- Click Register passkey and authenticate
Touch ID / Face ID / Windows Hello / etc. Your OS prompts you. If you last authenticated more than five minutes ago, Dalea asks you to re-authenticate first, with your password (plus your TOTP code when 2FA is on) or a linked Google or Microsoft account, then retries.
That's it. Next time you sign in, pick Sign in with passkey and your device handles the rest.
Managing passkeys
Same settings page lists every passkey on your account: its name, the date it was added, a Synced marker when the keychain backs it up across devices, and rename and delete buttons. Delete passkeys for devices you no longer have. Renaming is fine, it doesn't invalidate the key. Dalea does not track when a passkey was last used.
TOTP (when you can't use passkeys)
If your team is on email-and-password, add TOTP as a second factor. TOTP = the 6-digit code that rotates every 30 seconds in apps like 1Password, Google Authenticator, Authy, or your password manager.
Setting up TOTP
- Settings → Security → Two-Factor Authentication
Click Enable Two-Factor Authentication. An account with no password yet (created purely through Google or Microsoft) has to add one first, in the Password section just above.
- Confirm your password
Setup starts by asking for your account password.
- Scan the QR code
Use your authenticator app of choice, or copy the secret shown underneath. The app stores it and starts generating codes.
- Verify with the current code
Enter the 6-digit code from your app and click Verify & Enable.
- Save your backup codes
Dalea shows ten single-use backup codes. Save them in your password manager now. They're the only way back in if you lose your authenticator.
What changes after enabling TOTP
Every sign-in that uses your password now also asks for the rotating code. Sign-ins via OAuth (Google or Microsoft) and passkey are unaffected: those already prove device possession.
Two buttons appear on the section once 2FA is on: Regenerate Backup Codes and Disable 2FA. Both require you to re-authenticate with a strong factor, your password plus a TOTP code, a passkey, or a linked Google or Microsoft account, not the password alone.
Backup codes
Backup codes are single-use. Use one to sign in if you've lost your authenticator, then click Regenerate Backup Codes to mint a fresh set; the old ones stop working the moment you do. Regenerating goes through the same strong-factor re-authentication, so with the authenticator gone you need a passkey or a linked Google or Microsoft account to do it. Treat backup codes like the keys to the lab door: if someone has them they can sign in as you.
Mixing both
Passkey and TOTP is valid and secure but generally unnecessary; passkeys already prove device possession. The mainstream recommendation is:
- Use passkeys as your primary sign-in.
- Add TOTP as a second factor only on accounts that still rely on a password.
Recovery scenarios
- I lost my laptop
- Sign in from another device using your synced passkey, then delete the lost laptop's passkey from your account.
- I switched phones
- iCloud Keychain / Google PWM / Microsoft account migrate passkeys automatically. If you didn't use those, re-add a passkey on the new device.
- I lost my TOTP app
- Sign in with a backup code. Moving the secret to a new authenticator means disabling and re-enabling 2FA, and disabling needs a strong factor: a passkey or a linked Google/Microsoft account. Keep one of those available.
- I lost everything
- Contact Dalea support. Org admins hold no account-reset powers; recovery is a platform-admin action.