Set up your device sign-in (register your seal)

Your Axowl seal is a fingerprint / face / PIN key that lives only on this device. It is what lets you enter a workspace and approve things — no passwords, nothing to leak.

Before you can register a seal, your device needs a built-in sign-in called a platform authenticator:

• Windows → Windows Hello (PIN, fingerprint, or face)
• Mac → Touch ID
• iPhone / iPad → Face ID or Touch ID
• Android → screen lock (fingerprint or PIN)

If you see the message “Windows Hello isn’t set up on this PC yet…” (or the Touch ID / Face ID version), it does not mean your computer can’t do it — it just means the built-in sign-in hasn’t been turned on yet. This page turns it on, slowly.

The whole picture

   ┌──────────────────────────┐        ┌───────────────────────────┐
   │  1. Turn on device        │        │  2. Register your seal     │
   │     sign-in (one time)    │  ───►  │     in Axowl               │
   │                           │        │                            │
   │  Windows Hello / Touch ID │        │  "Seal this device"        │
   │  / Face ID / screen lock  │        │      → Continue → scan     │
   └──────────────────────────┘        └───────────────────────────┘
            do this once                     done each new device

You only do step 1 once per device. After that, registering a seal (step 2) takes a couple of seconds.

---

Windows — turn on Windows Hello

You just need a PIN. A fingerprint reader or camera is nice but not required — a PIN alone is enough.

  Settings ─► Accounts ─► Sign-in options ─► PIN (Windows Hello) ─► [Set up]
     ⚙            👤             🔑                                    │
                                                                       ▼
                                          ┌──────────────────────────────┐
                                          │ STEP 1  Confirm your account  │
                                          │         password first        │  ← Windows asks this
                                          └──────────────────────────────┘
                                                       │
                                                       ▼
                                          ┌──────────────────────────────┐
                                          │ STEP 2  Choose a new PIN       │
                                          │         and confirm it         │
                                          └──────────────────────────────┘

1. Press the Windows key, type Settings, open it. (⚙)
2. Click Accounts.
3. Click Sign-in options.
4. Find PIN (Windows Hello) and click Set up (or Add).
5. Step 1 — confirm your account password first. Windows shows “First, verify your account password” — type your existing Windows / Microsoft account password and click OK. (This is your normal login password, not a new PIN yet.)
6. Step 2 — now choose your PIN. Enter a new PIN, type it again to confirm, and click OK.
7. (Optional) If your PC has a fingerprint reader or camera, set up Fingerprint recognition or Facial recognition the same way.

The order matters

Windows will not let you jump straight to the PIN — it always asks you to confirm your account password first (Step 1), then lets you set the PIN (Step 2). If you don’t remember your account password, sort that out first.

Tip

A PIN is stored only on this PC — it is not your online password and never leaves the device. That is exactly why Axowl uses it: the key can’t be stolen from a server.

Now go back to Axowl and try Register / Seal this device again — the message is gone.

---

Mac — turn on Touch ID

  System Settings  ─►  Touch ID & Password  ─►  Add Fingerprint

1. Open System Settings (Apple menu → System Settings).
2. Click Touch ID & Password.
3. Click Add Fingerprint and follow the prompts.
4. In your browser, allow Touch ID for websites if asked.

Then return to Axowl and register your seal.

---

iPhone / iPad — turn on iCloud Keychain (passkey manager)

Most iPhones/iPads already have Face ID or Touch ID on. Since iOS 26.2, the missing piece is usually a passkey manager: your device needs iCloud Keychain (or another passkey provider) turned on before Safari can save a passkey.

  Settings  ─►  your name (Apple Account)  ─►  iCloud  ─►  Passwords & Keychain  ─►  ON

1. Open Settings and tap your name at the top.
2. Tap iCloud, then Passwords & Keychain (on some versions: Saved to iCloud → Passwords).
3. Turn it on.
4. Also check Face ID & Passcode (or Touch ID & Passcode) is set up.
5. Return to Safari and register your seal — approve with Face ID / Touch ID.

Don’t want iCloud Keychain? A hardware security key (YubiKey, Titan) plugged into the Lightning/USB-C port also works.

---

Android — set a screen lock

  Settings  ─►  Security  ─►  Screen lock / Fingerprint  ─►  set a PIN or fingerprint

1. Open Settings.
2. Tap Security (wording varies by phone).
3. Set a fingerprint or a PIN / pattern screen lock.
4. Return to your browser and register your seal — your passkey is saved to Google Password Manager.

Some organizations require device-bound seals (Security → Passkey Key Binding). In that case phone passkeys can’t be used — plug in a USB-C / NFC security key, or register from your desktop instead.

---

Step 2 — register the seal in Axowl

Once device sign-in is on, this part is quick.

   ┌─────────────────────────────┐
   │      Seal this device        │
   │  🛡  This device isn't        │
   │      sealed yet.             │
   │                              │
   │        [ Continue ]  ◄──── click
   └─────────────────────────────┘
                │
                ▼
   ┌─────────────────────────────┐
   │   🔒 Windows Security         │
   │   Scan your finger / enter    │
   │   your PIN                     │ ◄── your device asks you
   └─────────────────────────────┘
                │
                ▼
        ✅  You're in. You won't be
            asked again on this device.

1. When you enter a workspace without a seal, the “Seal this device” popup appears.
2. Click Continue.
3. Your device shows its own Windows Hello / Touch ID / Face ID prompt — scan or enter your PIN.
4. Done. The popup closes and you’re in. You will not be asked again on this device.

Each device is separate

A seal lives on one device only — nothing is copied between your machines. On a new computer you sign in another way first (email link or a social login), then register a seal on that machine too. That’s normal and by design: your key is never copied, so it can never be stolen in transit.

Still stuck?

• “…does not support Passkey” won’t go away after adding a PIN → fully close the browser and reopen it, then retry. If your browser is managed by your organization, a policy may block the built-in authenticator — try a normal (non-managed) browser.
• Remote Desktop / a virtual machine usually has no platform authenticator — register your seal on the physical machine instead.
• No fingerprint reader → you don’t need one. A PIN is enough on Windows.