Passkeys and sign-in

People sign in to Githome in the browser with a passkey (WebAuthn). There are no passwords. This page covers signing in, joining from an invite, adding and removing passkeys, managing signed-in browsers, the security emails you get, and how to get back in when you lose a passkey.

Passkeys are only for the web UI. Git, the githome CLI, scripts and MCP clients use personal access tokens instead (see Personal access tokens); the CLI gets its own when you approve githome login in the browser (see Install and sign in to the CLI). For your username, display name, profile picture and light or dark theme, see Profile and preferences.

#How passkey sign-in works

A passkey is a key pair that your device, browser or password manager creates for git.pkgforge.dev. Githome stores only the public key. When you sign in, your device proves it holds the private key after you unlock it with your fingerprint, face, PIN or screen lock.

Details that matter in practice:

Githome is invite-only, and open sign-up is off on git.pkgforge.dev. You can't create an account from the sign-in page: new people create their first passkey from an invite link (see Join from an invite). Anyone can browse and clone public repositories without an account.

#Sign in

1. Open https://git.pkgforge.dev/login, or any page that needs you to be signed in. Githome redirects you to the sign-in page and back to that page afterwards.
2. Click Sign in with a passkey.
3. Your browser shows its passkey prompt. Pick the passkey for your Githome account, or choose to use a phone or a security key if the browser offers it.
4. Unlock the passkey with your fingerprint, face, PIN or screen lock.

You land on the page you were trying to open (or your dashboard). To sign out, click Sign out in the header; that ends this browser's session only.

The sign-in page also says how to recover a lost passkey: "Ask an administrator for a sign-in link". The administrator is the superadmin.

#Join from an invite

The superadmin makes an instance invite in the dash and sends you its link, like https://git.pkgforge.dev/invite/<token>#proof=<proof>. Githome sends no email for it. Opening the whole link shows a Join Githome page:

1. Check the Username field. It is filled in from the part of your email address before the @; change it if you like. Usernames start with a letter or digit and use letters, digits, - and _, up to 39 characters. Some names are reserved (for example api, settings, login, admin, docs).
2. Optionally fill in a Display name (up to 100 characters).
3. Click Create a passkey and join, and complete your browser's passkey prompt.

Githome creates your account, saves the passkey, signs you in and shows "Welcome to Githome, <username>. You can sign in with this passkey from now on." You land on your dashboard. Where the deployment sends email, you also get a welcome email. Creating the account accepts every open invite sent to your email address.

If the email address already has an account, the invite page asks you to sign in with that account's passkey first; after that the same page shows an Accept invite button. See Invitations for how invites are created, how long they last and what each kind grants.

An invite of an organization or a repository goes to a person who has an account, and makes no account. Opening one whose address has no account answers 403 with Ask for an invitation.

#Open sign-up

The code of Githome has a setting for open sign-up, where anyone can create an account at /signup with a code sent to their email address. The setting is off on git.pkgforge.dev: /signup answers 404 (or leads to /early-access where Turnstile is set), the sign-in page has no Create an account link, and accounts come from invites. Ask the superadmin for an invitation link.

#Manage your passkeys

Go to Settings → Passkeys and sessions (/settings/security). The Passkeys box lists every passkey on your account with:

• its name,
• a synced badge when the passkey is backed up by your password manager or platform (so it syncs to your other devices), or this device only when it is stored on a single device or security key,
• when it was added and when it was last used to sign in (or "never used to sign in").

#Add a passkey

Add a passkey on each device you use, or keep one in a password manager that syncs, so losing one device doesn't lock you out.

1. On the device or browser you want to add, sign in and open Settings → Passkeys and sessions.
2. Under Add a passkey, optionally type a name (up to 100 characters). If you leave it empty, Githome names it after the device and browser, for example Mac · Safari or Android · Chrome.
3. Click Add a passkey and complete the browser prompt.

You see "Passkey "<name>" added." and, where the deployment sends email, Githome sends you a "A passkey was added to your account" email.

If the browser says "This device already has a passkey for this account.", the authenticator you picked already holds a Githome passkey for you. Pick a different one (another device, a phone or a security key).

#Remove a passkey

Click Remove next to the passkey and confirm. Removing a passkey also signs out every other browser that signed in with it, which is what you want for a lost or stolen device. The browser you are using stays signed in. Where the deployment sends email, Githome sends you a "A passkey was removed from your account" email.

You can't remove your last passkey. The list shows Only passkey instead of a Remove button, and the server refuses with "Add another passkey before removing your last one." Add a new passkey first, then remove the old one.

Passkeys can only be managed from a signed-in browser. An API request made with an access token gets "Sign in with your passkey first."

#Confirming it's you

Adding or removing a passkey, creating a token or an agent, changing your username, deleting or transferring a repository or organization, exporting or deleting your account, need a sign-in from the last 2 hours. If you signed in earlier, Githome shows Confirm it's you. Use your passkey, and you go back to the page you were on. Then do the action again. See Security overview.

#Sessions and signing out other browsers

Each successful sign-in creates a browser session, stored in an HTTP-only, secure cookie (__Host-ghome_session) that only git.pkgforge.dev can read. A session lasts 30 days and is extended by another 30 days on each day you use it, so a browser you use regularly stays signed in. However often you use it, a session ends 90 days after you signed in, and you sign in with your passkey again.

The Signed-in browsers box on Settings → Passkeys and sessions lists your active sessions (up to 100), newest activity first. Each row shows the device and browser, a this browser badge for the one you are using, when it signed in, how (a passkey or a sign-in link) and when it was last active.

To end one session, click Sign out on its row and confirm. You see "Signed out of that browser." To end every session except the current one, click Sign out everywhere else and confirm "Sign out every other browser?". You see "Signed out of every other browser." Those browsers need a passkey to sign in again.

When the superadmin disables your account, every browser session ends at once, and signing in again is refused with "Your account is disabled." until the account is enabled.

Signing out other browsers does not revoke access tokens. If you think someone has your token, revoke it under Settings → Access tokens (see Personal access tokens).

#Security emails about sign-in

Where the deployment sends email, these emails always send; you can't turn them off in notification settings.

A browser is identified by the passkey used plus its operating system and browser name (for example Mac · Chrome). Signing in again from the same browser with the same passkey doesn't send another email. The device you joined or added a passkey from counts as known.

If you get one of these emails and it wasn't you: open Settings → Passkeys and sessions, click Sign out everywhere else, remove any passkey you don't recognize, revoke any token you don't recognize under Settings → Access tokens, and tell the superadmin.

See Notifications for every email Githome sends.

#Recover your account

If you have lost every passkey (or the device that held your only passkey), ask the superadmin for a sign-in link. There is no email recovery. The link lets you add a new passkey to your existing account; your repositories, tokens and settings are untouched.

Recovering your account signs out every other browser signed in to it, in case the device you lost is one of them. Only browser sessions end: your access tokens keep working, so scripts and Git keep running. If you think someone has a token, revoke it under Settings → Access tokens once you are back in. The page you land on says "Every other browser signed in to your account was signed out; your access tokens keep working.", and the audit log records it as session.revoke_others.

#Sign-in link from an administrator

The superadmin can create a one-time sign-in link for you in the dash:

1. The superadmin opens the page People of the dash and clicks Sign-in link next to you (see Site administration).
2. The superadmin sends you the link through a channel you trust. githome sends no email for it.
3. Open the link (https://git.pkgforge.dev/signin#<token>). The Add a passkey page names the account it belongs to.
4. Optionally enter a Name for this passkey, click Create a passkey and complete the browser prompt.

You are signed in and taken to Settings → Passkeys and sessions with "Passkey "<name>" added. Use it to sign in from now on." Every other browser signed in to your account is signed out.

Anyone with the link can add a passkey to your account, so don't forward it. After you are back in, remove the passkey of the device you lost.

#No email recovery

git.pkgforge.dev has no recovery by email and no Cloudflare Access sign-in: /auth/access answers 404 with "Account recovery by email is not set up on this instance. Ask an administrator for a sign-in link." The sign-in link of the superadmin is the way back in.

#Browser and device requirements

• A browser with WebAuthn passkey support, such as a current version of Chrome, Safari, Edge or Firefox. In a browser without it, the sign-in button shows "This browser does not support passkeys. Try a current version of Chrome, Safari, Edge or Firefox."
• JavaScript turned on. Without it the page shows "Passkeys need JavaScript."
• An authenticator that can store a discoverable passkey and verify you: a phone or computer with a fingerprint reader, face unlock, PIN or screen lock, a password manager that supports passkeys, or a hardware security key that stores passkeys and has a PIN or biometric.
• The real site address. Passkeys are bound to git.pkgforge.dev, so they don't work through another hostname or a raw IP address.

#Password managers and synced passkeys

Passkeys saved in a password manager or your platform's keychain usually sync to your other devices, so one passkey covers your laptop and phone. Githome shows these with the synced badge. A passkey on a hardware security key or in a device-only store shows this device only; keep a second passkey somewhere else so you can't be locked out by losing that one key.

If your browser offers several places to save the passkey when you create it, pick the password manager or keychain you use on all your devices.

#How Githome sign-in differs from GitHub

• Githome has no passwords and no username-and-password sign-in, so there is no password reset and no separate two-factor setup: the passkey's user verification is the second factor.
• You can't sign up from the sign-in page: accounts come from invites, and open sign-up is off.
• Account recovery is a one-time link from the superadmin. There is no email recovery and there are no recovery codes.
• Git over HTTPS and the API never accept a passkey or browser session; they take a personal access token, much like GitHub.

#Troubleshooting