Signing in: PIN, password, code and passkey

How you sign in depends on how Rivo runs for you.

PIN

Set and change it in Settings → Access: on your own installation it is the sign-in PIN, in the Cloud the vault unlock PIN. On your own installation the first PIN is generated by the installer — change it on day one.

• Changing the PIN doesn't end sessions that are already open.
• Removing the PIN leaves the dashboard open to anyone who knows the address — only do that behind other protection (Cloudflare Access, for example).

Password (Cloud)

• 10 to 256 characters. Change it in Settings → Access → Account password.
• Too many failed attempts in a row lock sign-in for that email from that address for 15 minutes.
• A session lasts 30 days.
• Forgot your password? Use the link on the sign-in screen — we'll email a link that works once and for one hour; at most three emails an hour.
• The "set a password" screen has a checkbox to revoke passkeys. It's off by default: if you're changing the password because you suspect a break-in, turn it on.

Changing or resetting the password doesn't end other open sessions.

Two-factor authentication (Cloud)

After the password, sign-in can ask for a six-digit code from an authenticator app: Google Authenticator, 1Password, Aegis and others. Passkey sign-in doesn't ask for a code — a passkey is a second factor in itself.

Turn it on: Settings → Access → Two-factor authentication → "Turn on". Scan the QR code in the app (or type the key in by hand) and enter the code from the app — protection starts only after that code. Turning it on or off and issuing new codes are confirmed with a passkey on your device, or with the vault unlock PIN if there's no passkey.

Recovery codes. Right after you turn it on you get 10 one-time codes — they are shown once: copy or download them and keep them away from your phone. Each code replaces the app code for one sign-in. "New codes" issues a fresh set and the old ones stop working.

Signing in. Enter your email and password, then the code from the app. No phone at hand — choose "No access to the app? Use a recovery code". The iPhone app signs in the same way.

• 5 wrong codes in 15 minutes close code entry for the account for 15 minutes, and the owner gets a notification. Attempts are counted per account, not per address. Passkey sign-in keeps working.
• Resetting the password by email doesn't remove the protection: after the new password, sign-in still asks for the code.
• While the Cloud is suspended, signing in with a code works, but you can't turn the protection on or off or issue new codes.

Lost your phone. Sign in with a recovery code or a passkey linked to your account, then turn the protection off in settings and on again with the new phone. If you have neither codes nor a passkey, write to [email protected]: once your identity is verified, an operator removes the second factor (your password and passkeys stay as they are), and you turn it on again. The security log shows this as a separate event.

Passkey

A passkey is an access key on your device: Touch ID, Face ID, Windows Hello or a hardware key. Add one in Settings → Access → Add passkey.

Once you have a passkey, a PIN or password alone is not enough for important actions — you confirm them on the device:

• revealing a password, 2FA code or entry history in the vault;
• exporting the vault (including as plain text inside the all-data archive);
• adding or revoking a passkey, issuing a device token;
• deleting the account.

One confirmation lasts a few minutes in that browser (5 by default).

In the iPhone app, addresses on *.me.rivo.day have a "sign in with passkey" button. On your own domain (Self-host) the app can't sign in with a passkey — that's an Apple limitation; it uses the PIN or password there. See iPhone app.

Devices and pairing codes

Settings → Access also has:

• Extension code and App code — one-time codes valid for 10 minutes to pair the extension and the app when your account has a passkey;
• API tokens — access for scripts, MCP and bots, see API tokens and OpenAPI;
• Devices — tokens for Cloudflare Access (visible when the instance sits behind it).

A sign-in from a new address or a newly paired device triggers a notification linking to Settings → Access.