Managing Your Account & Passkeys

Your account across The Nest is managed by Keycloak, our central identity and access platform. Keycloak acts as the digital keyring for all services, ensuring your login experience is seamless, consistent, and passwordless.

What Keycloak Does

Keycloak works behind the scenes to handle three core functions:

Single Sign-On (SSO): Log in once to gain access to all connected Nest applications (such as Matrix, Forgejo, or Vaultwarden).
Passwordless Authentication: Securely verifies your identity using WebAuthn passkeys instead of traditional passwords.
Group Access Control: Grants or restricts access to specific services based on your account's group memberships.

Managing Your Passkeys

You have full control over your authentication devices! You can view, add, or remove passkeys at any time directly from your account dashboard.

Viewing Your Enrolled Passkeys

Visit sso.mynest.love and sign in.
Click on Account (or navigate to Security Devices).
Here, you will see a list of all devices and passkeys currently linked to your account.

Adding a New Passkey

From your Keycloak account page, navigate to Security Devices and click Add.
Follow your browser or device prompts to register your new passkey (e.g., a smartphone, security key, or browser password manager).
Give your passkey a recognizable name (such as "Work Laptop" or "Personal iPhone") to keep track of your devices easily.

Removing a Passkey

To remove an old device, locate it under Security Devices and select Delete.
Safety Feature: Keycloak prevents you from deleting your final remaining passkey to ensure you don't lock yourself out. You must enroll a replacement passkey before removing the last one.

Group-Based Permissions

Your access to different applications across The Nest is managed through Keycloak Groups. In most cases, group names match the service they unlock (for example, belonging to the foundry-vtt group gives you access to Foundry VTT).

To request access to additional services, please see the Requesting Service Access guide.

Account Recovery

If you lose access to all of your enrolled devices or passkeys:

Reach out to an administrator on Matrix at @nest:starling.mynest.love.
Verify your identity using the email address linked to your account.
An administrator will send you a secure recovery link to reset your credentials and register a new passkey.

Here are a few core platforms that integrate directly with Keycloak:

Matrix: Unified chat and voice login via SSO.
Vaultwarden: Can store and manage passkeys securely across devices.
Forgejo: Seamless identity management for code repositories.

Note

Screenshots of the Keycloak Security Devices page will be added in a future update!

3 KiB Raw Blame History