Account security

Everything protecting your account lives in Settings → Security: passkeys, two-factor authentication, linked sign-in methods, recovery contacts, and personal API keys.

The strongest everyday setup is a passkey plus 2FA — both take about a minute to enroll.

Passkeys

A passkey signs you in with your device’s own unlock — Face ID, Touch ID, Windows Hello, or your device PIN. Nothing to type, nothing to phish.

Add a passkey

1. Open Settings → Security → Passkeys and choose Add passkey.
2. Approve your device’s prompt. That’s it — the passkey is saved to your device (or your platform’s keychain, which can sync it across your devices).

Sign in with it — choose the passkey option on the sign-in screen and approve the prompt. No address or password needed.

Remove a passkey — delete it from the same list. Removing it in Knobs stops it from working; you can also delete it from your device’s password manager.

Add a passkey per device or let your platform sync one everywhere — and keep your password as a fallback.

Two-factor authentication (2FA)

With 2FA enrolled, password sign-ins require a second step. Two methods:

• Authenticator app (TOTP) — recommended:
  1. Go to Settings → Security → Two-factor authentication and choose the authenticator option.
  2. Scan the QR code with your authenticator app (or enter the setup key manually).
  3. Enter the app’s 6-digit code to confirm.
• SMS — enter your phone number, then confirm with the code Knobs texts you.

After enrollment, sign-ins with your password prompt for a current code.

Linked sign-in methods

Settings → Security → Sign-in methods shows how you can sign in:

• GitHub — link your GitHub account to enable one-click Continue with GitHub at sign-in. Unlink it any time; your password and passkeys are unaffected.

API keys

Personal API keys give scripts and tools programmatic access to Knobs as you — every call an API key makes carries exactly your permissions in your workspaces.

Create a key

1. Open Settings → Security → API keys and choose Create key.
2. Name it after what will use it (e.g. reporting-script).
3. Optionally set an expiry date (up to a year out). Keys without an expiry live until revoked.
4. Copy the key now — it’s shown exactly once. Afterward only a hint (knak_…last4) is displayed.

Manage keys

• The list shows each key’s name, hint, creation and expiry dates, and when it was last used — handy for spotting keys that are dead weight.
• Revoke takes effect immediately.
• You can hold up to 25 keys at a time.

What keys can’t do: an API key can never manage credentials — no adding passkeys, changing 2FA, editing recovery contacts, or creating/revoking API keys (including itself). Those actions always require you, signed in. See the API keys reference for usage details.

Caution

Treat an API key like a password: store it in a secret manager, never commit it to a repo, and revoke it the moment you suspect exposure.

Sessions

Signing in creates a short-lived session that refreshes automatically while you use the app — you won’t be interrupted mid-work, and idle sessions age out on their own. Use Sign out (avatar menu) to end the session on a device you’re leaving, and if you believe your password was compromised, change it and complete account recovery — resetting the password signs out your other sessions.