Aloware gives every user a Security section in Admin and in Talk. From it, users see every app and browser signed in to their account and sign any of them out, set up an authenticator app such as Google Authenticator in place of the emailed sign-in code, and add passkeys.

A passkey signs the user in with their fingerprint, face or screen lock, with no password and no code. The sign-in pages of Admin and Talk also offer Sign in with Google and Sign in with a passkey.

Each user manages their own Security section. It appears only on your own profile, and a link to another user's Security tab opens their Profile instead.

Both show three cards: Authenticator app, Passkeys and Signed-in devices. While Aloware support is signed in to your account, the cards still show, but nothing on them can be changed.

The Signed-in devices card lists every app and browser signed in to your account, most recently used first, up to 50. Each row shows the following details:

To end one session, open the row's ⋯ menu and select Sign out.

To end every session except the one you are using, click Sign out of other devices. Signing one device out leaves your other devices signed in.

A signed-out app returns to its sign-in page the next time it contacts Aloware and shows "Your session has ended. Please sign in again."

Each app and device signs in separately and stays signed in as long as it is used at least once every 30 days.

A device also has to sign in again after it is signed out from the Security section, after the support session it belonged to ends, or after the account is moved or its credentials are reset.

A session that started before the Security section was available appears once that app signs in again. Older builds of the mobile and desktop apps do not appear at all until you update the app and sign in again.

The list includes these versions and later:

An authenticator app gives you a 6-digit code at sign-in in place of the emailed code. Any authenticator app works, such as Google Authenticator, Microsoft Authenticator or 1Password.

Once the authenticator app is on, the card shows the date it was turned on and how many recovery codes are left. New recovery codes creates 8 new codes, and the old ones stop working. Turn off returns you to emailed codes. Both ask for your password.

The emailed code stays available as a backup. The authenticator app replaces the emailed code at sign-in; it is not an extra step on top of it.

On the code step, select Use a recovery code and enter one of your saved recovery codes, or select Email me a code instead.

Once you are signed in, open the Security section and turn the authenticator app off, or turn it off and set it up again on your new phone.

A passkey is another way to sign in. Your password, your sign-in code and Sign in with Google keep working after you add one.

A passkey you add in Admin also works in Talk, and a passkey you add in Talk also works in Admin.

An account can keep up to 20 passkeys. Each row on the card shows the passkey's name, the password manager that keeps it when that differs from the name, when it was last used and when it was added. Use the row's ⋯ menu to rename or remove a passkey.

The Passkeys card and the Sign in with a passkey button show only where passkeys work. They do not show on white-label hosts, or in a browser that cannot create passkeys. That browser shows "This browser can't make passkeys. Use a current version of Chrome, Safari, Edge or Firefox."

In Talk for desktop 1.99.7 or later, Add a passkey opens Talk in your browser on the Security section with the add dialog already open. Talk for iPhone and Talk for Android do not offer passkeys.

After a sign-in without a passkey, Aloware shows a Sign in faster with a passkey card once per account, with Not now and Add a passkey.

Add a passkey opens the Security section with the add dialog open. The card does not show in Talk for desktop, during a support session, or where passkeys are not available.

The sign-in pages of Admin and Talk show Sign in with Google and Sign in with a passkey above the email and password form.

After you enter your password, the code step asks for the code from the method you use:

Older builds of Talk for desktop, iPhone and Android may still say "Check your email" to authenticator users. The authenticator code works there too, and Send a new code emails the backup code. Talk for Android also emails a code at each sign-in.

Sign in with Google signs you in as the Aloware user whose email matches the Google account, and it skips the code step. Every user can use it; there is no account setting to turn on.

The sign-in page shows one of these messages when Google sign-in cannot complete:

On Admin and on Talk in a browser, Sign in with a passkey asks your browser for a passkey. Clicking the email field also offers your saved passkeys, the same way browsers offer saved passwords. A passkey sign-in skips the code step, and the same rules that apply to a password sign-in apply here.

Talk for desktop 1.99.7 or later opens a Sign in to Talk page in your browser. After you use your passkey there, the browser hands the sign-in back to Talk, which shows "Finish in your browser…" while it waits. The hand-back works once and expires after two minutes.

Talk for desktop shows one of these messages when a passkey sign-in cannot complete:

A password reset link works once and expires after 60 minutes. The reset email says "This link expires in 60 minutes." An expired or used link shows "This link has expired or was already used. Please request a new password reset." To get a new link, click Forgot password on the sign-in page.

The table shows which sign-in and security options each Aloware app supports.