Security

Manage authentication methods and security options from Settings. WealthMgr uses Better-auth with WebAuthn for passkeys. Registration requires an invite code or waitlist sign-up.

Passkeys

Passkeys are the primary sign-in method. They use device biometrics (Face ID, fingerprint) or a hardware security key — no password involved.

Adding a passkey

1. Open Settings.
2. Go to the Passkeys section.
3. Click Add passkey and give it a name (e.g. "MacBook Touch ID" or "YubiKey 5").
4. Complete the browser registration prompt.

Register one passkey per device. Each entry shows its name and creation date.

Hardware security keys

FIDO2-compliant keys (YubiKey, Google Titan) register the same way as built-in passkeys. Insert the key and follow the browser prompt.

Removing a passkey

Delete a passkey with the trash icon on its row. You cannot remove your last authentication method — at least one passkey or a password must remain.

Password

Passwords complement passkeys or serve as a fallback if you registered with email only. Passwords must be 12–128 characters with complexity enforced.

Changing your password

1. Open Settings.
2. Navigate to the Password section.
3. Enter your current password, then your new password and confirmation.
4. Click Change password.

Lost access

If you cannot sign in via passkey and do not recall your password, use the recovery flow at /forgot-password → /reset-password. A token link is sent via email (production email integration status may vary). There are also dedicated passkey recovery routes (/forgot-passkey, /recover-passkey). In the meantime, the team can create a reset link using the create-user-and-reset-link CLI script.

Sessions last 7 days and are automatically refreshed every 24 hours.

Two-factor authentication

Add a second factor using any TOTP authenticator app (Google Authenticator, Authy, 1Password, Bitwarden). This sits on top of your existing passkey or password login. Requires your password to enable or disable.

Enabling 2FA

1. Open Settings.
2. Open the Two-factor authentication section.
3. Click Enable 2FA.
4. Scan the displayed QR code with your authenticator app.
5. Enter the 6-digit code to confirm.
6. Save the provided backup codes.

Backup codes

WealthMgr generates single-use backup codes when you enable 2FA. Store them securely — printed copy, password manager, anywhere offline. A backup code lets you sign in when your authenticator is unavailable, after which you can enrol a new device.

Turning off 2FA

Disable 2FA from the same section. Confirm with your current TOTP code.

Email verification

Email verification is required during sign-up. A verification email is sent automatically; visit /verify-email to check status. If you need to resend the verification email, go to Settings and click Send verification email.

Invitations

Registration is invite-only during the beta: every new account needs a valid invitation code. If you have access to the app, you can hand that access on from Invitations — open the account menu in the app header and pick Invitations.

1. Click **Create invitation**. A new single-use code is generated and shown once, together with a ready-to-share registration link.
2. Click **Copy link** and send it to your guest. They can register with a passkey or with email and password — the invite only gates the door, it doesn't pick your sign-in method.

The page’s Your invitation codes list keeps everything you’ve created, each marked Unused, Used (with the date), or Expired. A code can be used once; after someone registers with it, generate a new one for the next guest. Unused codes also expire, so a stale link can’t sit around forever — if a guest reports a dead link, create a fresh code rather than digging up the old one.