> For the complete documentation index, see [llms.txt](https://docs.madhousewallet.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.madhousewallet.com/security/login-to-the-wallet.md).

# Authentication

Madhouse Wallet uses **multi-factor authentication (MFA)** combining email verification and **WebAuthn passkeys** — no passwords.

***

## Signing In

Login requires two sequential factors:

1. Go to [business.madhousewallet.com](https://business.madhousewallet.com)
2. Enter your account email
3. **Factor 1 — Email OTP:** A 6-digit code is sent to your email. Enter it to confirm you control the address.
4. **Factor 2 — Passkey:** Authenticate with your registered passkey — Touch ID, Face ID, Windows Hello, or a hardware security key (YubiKey, etc.)
5. You're in

Both factors must be completed successfully in sequence. A valid passkey alone is not sufficient without the prior email verification step.

***

## How Passkeys Work

A passkey is a cryptographic key pair generated by your device. The private key is stored in your device's secure enclave and never leaves it. The server stores only the public key.

When you authenticate with your passkey:

1. The server issues a challenge
2. Your device signs the challenge with your private key (biometric confirmation required)
3. The server verifies the signature against your stored public key

No password is ever transmitted. Phishing is structurally impossible — the passkey is bound to the domain.

***

## Why MFA?

The email OTP step adds a second, independent factor that cannot be satisfied by passkey compromise alone. Even if a threat actor obtained physical access to an enrolled device, they would also need access to the registered email inbox to complete login.

***

## Adding a Passkey

From **Settings → Passkeys**, you can register additional passkeys (e.g. a YubiKey as a backup). You can have multiple passkeys on one account.

Using a hardware security key (YubiKey or similar FIDO2 device) is recommended for maximum security — it cannot be compromised by malware on the host device.

***

## Removing a Passkey

Passkeys can be renamed or deleted from **Settings → Passkeys**. Deleting your last passkey is blocked — you must always have at least one registered.

If you lose access to all your passkeys, account recovery is available via email OTP verification.