← Help Center

BU passkeys & account recovery

A documented procedure for users, BU administrators and SupaChrome Support.

Procedure version 1 · 5 October 2026

One registered device

Each BU user can register one passkey. SupaChrome requires device verification and rejects credentials marked as eligible for backup or synchronization. It requests a built-in device authenticator and rejects remote-device responses. Windows Hello on a compatible local device is one supported option; many Apple and Google password-manager passkeys are synced and cannot be used under this policy.

This policy restricts registered WebAuthn credentials. It is not a managed-device inventory or a guarantee against a compromised device. Password and BU PIN sign-in is available only to change a temporary password, register a passkey, or recover a device. Every BU user must complete passkey verification before opening CRM or connecting an AI client. SupaChrome does not receive or store your fingerprint, face data or device PIN.

1. Set up your passkey

  1. Open https://login.supachrome.com and sign in with your BU code, email, password and BU PIN. If your password is temporary, change it before setting up a passkey.
  2. Before CRM access, the required passkey setup screen opens automatically. Open Your BU passkey there. Enter a device name, your current password and BU PIN, then choose Set up passkey on this device.
  3. Approve the device prompt using its fingerprint, face unlock or device PIN. The device must provide a local, device-bound credential. A synced credential will be rejected.
  4. Save the recovery code shown once. Keep it in a secure location separate from the registered device. Confirm that you saved it. SupaChrome stores only its hash.
  5. For future sign-ins, enter your BU code and email, then choose Sign in with passkey. Password/PIN sign-in opens only setup and recovery. Your business role, user status, BU status and Trial expiry are still checked.

2. Change your device

  1. While you still have the old device, sign in and open Settings → Security → Your BU passkey.
  2. Choose I can unlock the registered device. Enter your current password and BU PIN, then choose Verify and remove passkey. Approve the old device prompt.
  3. Removal signs out your sessions, ends sessions impersonating your account, revokes your AI connections and invalidates the old recovery code. The old passkey can no longer sign in.
  4. On the new device, sign in using your BU code, email, password and BU PIN. Register a new passkey and save the new recovery code. SupaChrome never keeps two registered passkeys for the same user.
  5. You may also remove the obsolete SupaChrome entry from your old device’s passkey manager. Deleting it only from the device does not remove the server registration.

3. Lost device or passkey failure

  1. First confirm that you opened login.supachrome.com, selected the correct BU and email, and can unlock the registered device. A cancelled or expired prompt does not remove your passkey.
  2. If the device is lost or unusable, sign in with your existing account credentials. Open Settings → Security → Your BU passkey and choose Use my saved recovery code.
  3. Enter your password, BU PIN and saved recovery code. Verify and remove passkey. The code works once; removal revokes the passkey, existing sessions and connected AI clients.
  4. Sign in again with your account credentials, set up the replacement device and save its new recovery code. If you suspect someone else accessed your account, also change your password and ask your BU owner to review access.

4. Administrator-assisted recovery

  1. If you have no recovery code or cannot sign in, contact an authorized BU administrator through your organization’s established support channel. Provide your BU code and registered email. Never send a password, BU PIN, passkey secret or recovery code.
  2. The administrator must verify the request using a known organizational contact or a callback to an existing trusted contact. A new email address or the request message alone is not sufficient. Record the support ticket and verification reference; do not put sensitive credentials in that note.
  3. For an ordinary BU user, an authorized administrator opens Users & roles → the user menu → Reset password. The administrator confirms identity verification and records the reference. An administrator cannot recover an account with greater permissions; a BU owner must handle it.
  4. For a BU owner, another signed-in BU owner can assist. If no owner can access the BU, contact SupaChrome Support at contact@supachrome.com or supachrome.com/contact. Support verifies ownership against the existing business and owner contact records, using an independent callback or established verification process. A new email address or an email claim alone is not enough.
  5. After ownership is verified, Support coordinates the access reset with authorized business contacts. The affected owner will receive new temporary credentials; the reset also changes the shared BU PIN and ends active BU sessions and connected AI access. Other users should be told to sign in again using the new PIN. Their own registered passkeys remain associated with their accounts.
  6. Temporary credentials are sent to the existing registered email and expire after 48 hours. If email delivery fails, deliver them only through an independently verified secure channel. Do not change the destination email as part of recovery without a separate identity process.
  7. The recovered user signs in, sets a new password, registers one replacement passkey and saves its new recovery code. Reconnect any required AI clients through OAuth. The administrator reviews the recovery event in the BU Audit Trail and closes the support ticket.

Where to find recovery records

The BU Audit Trail records passkey registration, successful passkey login, removal and administrator credential resets. Recovery notes record the support reference and acting administrator. Registration and self-service removal attempt a notification to the registered email; the page reports if it cannot be delivered. Recovery codes are shown only during setup and cannot be retrieved by administrators.