> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fased.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Wallet passkeys

# Wallet passkeys

Fased has two separate optional concepts. Neither is part of installation or
terminal wallet onboarding.

## Control UI account passkey

The **Control UI account passkey** lives under **Account Security**. It adds
WebAuthn protection to the web account and selected Gateway settings/actions.

It does not:

* create or unlock a wallet;
* affect Agent or Mining readiness;
* authorize signer execution by itself;
* replace a signer policy; or
* encrypt a recovery package.

Users may enable or skip it. Gateway login is not signer authorization.

## Vault approval device

A native Vault may optionally use a signer-owned approval device for exact
manual Vault reviews. The Vault's **Security** panel explains this separate
readiness requirement; it does not enroll the device through ordinary Gateway
JavaScript. Enrollment is a native signer-owner ceremony. On Hosting, run
`/usr/local/sbin/fased-signer-enroll` from the provider root console. It is
separate from the Control UI account passkey.

Agent and Mining do not receive a passkey prompt for automatic operations inside
their narrow typed policies. An Agent/Mining request outside policy is rejected
unless the owner separately enables an exact reviewed lane.

## Recovery passwords are different

The recovery password encrypts an exported recovery package with Argon2id and
authenticated encryption. It is entered directly into the native signer in the
terminal. It is not a passkey and never enters the Control UI.

Related:

* [Wallets](/plugins/crypto/wallet-page)
* [Self-hosted signer](/plugins/crypto/wallet-self-hosted)
* [Wallet CLI](/cli/wallet)