Most passkey elevation problems come down to a handful of verified boundaries: a lost passkey, an API key or automated flow that was never challenged, elevation not carrying between organisations, and impersonation sessions that cannot verify. Match your symptom below; if your case is a lost passkey, the fix is to have an owner or admin contact Ploy support to remove the stranded credential.
A passkey lives on a device you control or in a password manager. If you lose your only one, you cannot elevate — which includes not being able to remove the passkey that no longer exists.
Recovery: an owner or admin contacts Ploy support, who can remove the stranded credential. You then register a fresh one, and because you hold none, that registration is not gated.
Ploy support can only ever remove a credential. Nobody at Ploy can add one to an account or verify on your behalf.
This is expected. Elevation itself is per organisation: verifying in one Ploy organisation does not carry into another, so switching organisations means verifying again there.
The passkey itself is not the issue — a passkey belongs to you, not to an organisation, so if you work in several Ploy organisations you register once and it works in all of them. Only the elevation is per organisation.
Each verification requires a biometric or a device PIN, not just possession of the device. Check that the passkey is on the current device or in a password manager you can open, and that you are unlocking it with the correct biometric or PIN.
No. Passkey elevation is not a sign-in method and not login multi-factor authentication. You sign in exactly as you do today, with SSO or a magic link, and the passkey is only ever asked for at the point of a protected action.
No. Signing in works exactly as it does today. The passkey is only requested when you perform a protected action, never when you log in.
Nobody is locked out for not having one. If you attempt a protected action without a passkey, you are asked to register one there and then. Registering your first passkey is never itself gated, so enrolment always works.
One verification keeps your session elevated for a window that defaults to 15 minutes and can be set anywhere from 1 minute to 8 hours. Repeated protected actions inside that window do not re-prompt you. Changing the window does not affect anyone who has already verified.
No. A protected action can never be performed autonomously by Luna. It is held for human confirmation, and the person confirming must have an elevated session. One verification covers confirming a batch of them.
A passkey lives on a device you control — a laptop, phone, or hardware key — or in a password manager, and each use is unlocked with a biometric or a device PIN.