Skip to content
WealthMgr Docs

Security

Manage authentication methods and security options from Settings. WealthMgr uses Better-auth with WebAuthn for passkeys. Registration requires an invite code or waitlist sign-up.

Passkeys

Passkeys are the primary sign-in method. They use device biometrics (Face ID, fingerprint) or a hardware security key — no password involved.

Adding a passkey

  1. Open Settings.
  2. Go to the Passkeys section.
  3. Click Add passkey and give it a name (e.g. "MacBook Touch ID" or "YubiKey 5").
  4. Complete the browser registration prompt.

Register one passkey per device. Each entry shows its name and creation date.

Hardware security keys

FIDO2-compliant keys (YubiKey, Google Titan) register the same way as built-in passkeys. Insert the key and follow the browser prompt.

Removing a passkey

Delete a passkey with the trash icon on its row. You cannot remove your last authentication method — at least one passkey or a password must remain.

Warning

Losing all passkeys with no password means lockout. Keep a backup method active.

Password

Passwords complement passkeys or serve as a fallback if you registered with email only. Passwords must be 12–128 characters with complexity enforced.

Changing your password

  1. Open Settings.
  2. Navigate to the Password section.
  3. Enter your current password, then your new password and confirmation.
  4. Click Change password.

Lost access

If you cannot sign in via passkey and do not recall your password, use the recovery flow at /forgot-password → /reset-password. A token link is sent via email (production email integration status may vary). There are also dedicated passkey recovery routes (/forgot-passkey, /recover-passkey). In the meantime, the team can create a reset link using the create-user-and-reset-link CLI script.

Sessions last 7 days and are automatically refreshed every 24 hours.

Two-factor authentication

Add a second factor using any TOTP authenticator app (Google Authenticator, Authy, 1Password, Bitwarden). This sits on top of your existing passkey or password login. Requires your password to enable or disable.

Enabling 2FA

  1. Open Settings.
  2. Open the Two-factor authentication section.
  3. Click Enable 2FA.
  4. Scan the displayed QR code with your authenticator app.
  5. Enter the 6-digit code to confirm.
  6. Save the provided backup codes.

Backup codes

WealthMgr generates single-use backup codes when you enable 2FA. Store them securely — printed copy, password manager, anywhere offline. A backup code lets you sign in when your authenticator is unavailable, after which you can enrol a new device.

Warning

Backup codes appear only once. Lose them and your authenticator simultaneously, and you must use the recovery flow.

Turning off 2FA

Disable 2FA from the same section. Confirm with your current TOTP code.

Email verification

Email verification is required during sign-up. A verification email is sent automatically; visit /verify-email to check status. If you need to resend the verification email, go to Settings and click Send verification email.

Info

The email-sending hooks are currently stubbed in production (see `src/lib/server/auth.ts`). Verification emails may not be delivered until the email integration is enabled. Contact support if you encounter issues.