Account & security
Account
Passkeys step 1 · fingerprint or face
Each device you sign in on with a touch or a glance has its own passkey. Add one for every phone or computer you use.
This browser cannot create passkeys. Open the ledger in Chrome or Safari on a phone or computer with a screen lock, then set one up from here.
Seeing “Something went wrong” from your phone?
- Make sure the device has a screen lock (PIN, fingerprint or face) turned on.
- Android: check you are signed in to a Google account, Google Password Manager is on (Settings → Passwords & accounts), and Google Play services is up to date. Then try again.
- iPhone: turn on iCloud Keychain (Settings → your name → iCloud → Passwords and Keychain).
- When the prompt offers other choices — a password manager, another phone or a security key — any of them works.
- Open the app in Chrome or Safari rather than inside another app’s built-in browser.
Authenticator app step 2 · required
2-step verification is on and cannot be turned off. Every sign-in asks for the six-digit code from the authenticator app you set up. Once you are signed in, the device stays signed in for 30 days, or until you sign out.
Security codes single use
Security codes are single-use codes for where passkeys are not supported, or for when your phone is not to hand. Each works once, in place of either step — never both. Making a new set cancels every old code.
— unused codes left
These are shown once. Save them before leaving this page.
Administration admins only
Invite a staff member
Accounts are by invitation only. An invite works once, only for the email address it names, and expires after 7 days. Once it is made, email it straight from here or copy the link; making a new invite for the same address cancels the old one.
Invite link for , shown once:
Email invite opens this device’s email app with the message written and addressed — check it and press Send. If you use email in the browser, or nothing opens, use Gmail or Outlook instead, or Copy message and paste it into any email.
Staff
SF-270 feed keys
An outside system, such as the intake portal or a spreadsheet, reads /api/sf270 with a key. Send it as Authorization: Bearer <key>, or add ?token=<key> to the URL where headers cannot be set. Give each system its own key, so one can be revoked without breaking the others.
Feed key, shown once. Store it in the outside system now:
This session
On a shared phone or computer, erasing removes this device’s copy of the ledger, signatures, drafts and receipt photos. Records already sent to the program database stay there.