Confirm it's you is a short check Bluedeer makes before you add or remove a passkey, when your last sign-in is not recent. Changing your passkeys changes how your account can be signed in to, so Bluedeer asks you to prove it's you first.
This check happens in Settings, after you are already signed in. It is different from the sign-in step for two-factor authentication. When two-factor authentication is on, that sign-in step also says Confirm it's you, and it asks for the 6-digit code from your authenticator app. The code is never asked for in this check.
When it asks
Bluedeer asks only when your last sign-in was more than 15 minutes ago. Signing in recently is enough to add or remove a passkey straight away.
- Add a passkey or Remove a passkey: if your last sign-in is older than 15 minutes, the Confirm it's you window opens before you can make the change. On the web app it appears in place of the Add a passkey window, so you confirm before you name the passkey.
- Rename a passkey: this never asks.
After you confirm, you have 15 minutes to make your changes. Once those 15 minutes pass, the next add or remove asks again.
How to confirm
On the web app, the window says Confirm it's you and explains that you signed in a while ago. There are up to three ways to continue:
- Password: type your password, then click Confirm. This box only appears if your account has a password.
- Use a passkey: click Use a passkey and confirm with your fingerprint, face or device PIN. This only appears if your account has a passkey and your browser or device can use passkeys. The passkey must be one already on your account.
- Sign out and sign in again: click the link at the bottom of the window. Then sign in, come back to Settings within 15 minutes, and make your change. This link is always there on the web app.
On the phone, the window has a password box with Confirm, a Use a passkey button when your phone can use passkeys, and Cancel. The phone window has no sign-out link. Choosing Cancel leaves your passkeys as they were.
If the password or passkey doesn't confirm it's you, Bluedeer says why and you can try again. For example, it says "That password isn't right." for a wrong password, or "That passkey belongs to a different account." for a passkey from another account.
If you signed in with Apple or Google only
Some accounts have no password and no passkey, for example an account you only sign in to with Apple or Google. There is nothing to confirm with. On the web app, the window then only offers sign out and sign in again. Sign in with Apple or Google, go back to Passkeys within 15 minutes, and add the passkey right away.
On the phone, tap Cancel, sign out from Settings, then sign in with Apple or Google and add the passkey within 15 minutes.
Bluedeer also won't remove your last passkey if it is the only way left to sign in. See How do I add a passkey and sign in with it?
Why Bluedeer asks
A passkey lets its holder sign in without your password, so changing your passkeys is as sensitive as changing your password. Asking for your password or a passkey again, when your sign-in is not recent, means that someone who finds an open, signed-in browser or phone cannot change your passkeys by themselves.
Bluedeer emails you when a passkey is added, renamed or removed, so you will know if it wasn't you. See Which emails does Bluedeer send?