# Your Account (Keycloak) — Identity & Passkeys

Your identity on The Nest is managed by [Keycloak](https://keycloak.org/), an open-source identity and access management platform. Keycloak handles authentication, passkeys, and group-based authorization for all services.

## What Keycloak Does

- **Authentication:** Verifies your identity using WebAuthn passkeys (passwordless).
- **Authorization:** Determines which services you can access based on your Keycloak groups.
- **Single Sign-On (SSO):** One login grants access to all connected services (Matrix, Forgejo, Nextcloud, etc.).

## Managing Your Account

### Viewing Enrolled Passkeys

1. Visit [sso.mynest.love](https://sso.mynest.love).
2. Click **Account** (after signing in).
3. Under **Security Devices**, you'll see all enrolled passkeys.

### Adding a New Passkey

1. Go to **Security Devices → Add** on the Keycloak account page.
2. Follow the prompts to register a new device (smartphone, security key, etc.).
3. Give it a recognizable name (e.g., "iPhone 15" or "YubiKey").

### Removing a Passkey

You can remove a passkey from **Security Devices**, but you must have at least one remaining. If you're down to your last passkey, Keycloak will prevent removal and prompt you to add another first.

## Group-Based Access

Your access to services is controlled by Keycloak groups. See [Requesting Service Access](../access-requests.md) for details on how to request new groups.

Common groups include:

| Group | Services Unlocked |
|-------|-------------------|
| `media-users` | Jellyfin, Sonarr, Radarr, Bazarr |
| `music-users` | DroppedNeedle, slskd |
| `books-users` | Calibre-Web, Shelfmark, Audiobookshelf |
| `storage-users` | Nextcloud |
| `ttrpg-users` | Foundry VTT |

## Account Recovery

If you lose access to all enrolled passkeys:

1. Contact an admin via Matrix (`@nest:starling.mynest.love`).
2. Verify your identity using your registered email address.
3. The admin will reset your account, allowing you to re-enroll passkeys.

## Related Services

- [Matrix](../communication-and-security/matrix.md) — Uses Keycloak for SSO login
- [Vaultwarden](../communication-and-security/vaultwarden.md) — Can store passkey credentials securely
- [Forgejo](../productivity-and-creation/forgejo.md) — Uses Keycloak for authentication

---

*TODO: Add screenshot of Keycloak account page showing security devices.*