帮助 · 02
Your keys
What your owner and recovery passkeys do, who holds each key that administers your ledger, and what A-REX can and cannot do without you.
Your company's records are administered by keys. This guide explains, in plain words, which keys exist, who holds them and why you register two passkeys. When you are done, you know what A-REX can do for you and what it can never do alone.
Passkeys in plain words
A passkey is a digital key stored on your phone, your computer or a small security key. You unlock it with your fingerprint, your face or a PIN. Nobody can copy it from the device.
You may meet passkeys in two places:
- Sign-in passkeys, added in Your sign-in with Add passkey. They only let you sign in.
- Administration passkeys: the Owner passkey and the Recovery passkey. They approve changes to your company's administration account.
Your administration account
The administration account is the account that sets the rules of your ledger: which partners may receive lots, which labs may sign certificates, which partners may record processing, and which version of the ledger software runs. It needs more than one key to act.
| Custody | Keys | Approvals needed |
|---|---|---|
| Managed custody | your owner passkey, your recovery passkey, the A-REX operations key | 2 of 3 |
| Keys on your devices | your owner passkey, your recovery passkey | 1 of 2 |
Your legal home decides which custody is available. See Your legal home.
Register both passkeys
- Open the Keys step of the setup, or Jurisdiction & custody.
- Under Owner passkey, select Register on this device. Only the owner can do this.
- Register the Recovery passkey on another device or security key, or let another administrator register it. One device must not hold both keys.
- Select Continue: it is available once both passkeys are registered. Then, in the Ledger step, select Prepare my ledger.
If you lose the device with your owner passkey, the recovery passkey confirms its replacement. Keep it on another device, on a security key in a safe place, or with another administrator.
What A-REX can and cannot do
- A-REX prepares the work but can never approve a change to your administration account alone. With managed custody it holds one key of three, and its key is never enough. With keys on your devices it holds none.
- Your organization can act without A-REX: with managed custody your two passkeys reach the threshold on their own.
- A-REX keeps accounts for your partners so they can receive lots without installing anything. A-REX holds the only key of these accounts (a cloud key, AWS KMS) and uses it only to carry out what a person in your company approved. That rule is enforced by the platform, not by the key itself.
- You can hand these accounts over to your administration account at any time with Hand them over to your administration account. The owner gives the approval, and afterwards A-REX cannot move lots out of them.
- If A-REX ceases to operate, your records remain verifiable without A-REX. With your keys you can move the administration to an account of your own, and export your data (EPCIS 2.0) beforehand.
Jurisdiction & custody shows all of this for your company under Who holds the keys.
Accounts created before October 2026
If the page says A-REX still holds your recovery key, register a recovery passkey, then sign with your owner passkey to move the recovery key to your side. A-REX then holds only one key of three.
If you lose a passkey
See I lost my passkey.