Passwordless Login

Use a passkey or FIDO security key first. OTP is a fallback and step-up path, never the primary credential.

Start Login

Email Origin Active scope Local seed principal for OTP fallback

Primary login is passkey or FIDO DiyaOS should prefer phishing-resistant authenticators for every human admin and user.

OTP is not a password substitute Use OTP for periodic verification, step-up, or recovery when the account posture requires it.

Forgot password means recover access Lost-device users go through recovery and replacement credential setup instead of password reset.

Ready for passwordless login Start with a passkey when the device supports it, or request OTP only when a step-up or fallback is required.