Authii encrypts your data with a key the server never sees. To do that we rely on a WebAuthn extension called PRF, which most modern passkeys support — but a few don't yet, and a few need a software update first. If you've seen a “PRF not supported” message, this page tells you what to change.
If your laptop lid is closed:Touch ID isn't reachable. iPhone-via-QR is the cleanest fix — same passkey works once the Mac lid is open later.
Bitwarden / 1Password browser extensions don't work with Authii right now.Bitwarden's “PRF support” announcement covered logging into the Bitwarden vault with a PRF-capable passkey from elsewhere — not offering PRF on passkeys stored insideBitwarden's extension. That second piece is an open Bitwarden feature request with no ETA. Until it ships, in the Bitwarden popup click “Use a phone, tablet, or security key” — that routes through the system passkey UI (iCloud Keychain on Mac) which does support PRF.
Bitwarden / 1Password browser extensions don't work with Authii. Their PRF announcements covered logging into their own vaults; passkeys stored insidethose extensions don't yet provide PRF to third-party sites. Open feature request, no ETA. Click “Use a phone, tablet, or security key” in the popup to route through the system Hello / hybrid UI instead.
Heads-up:if you've set Bitwarden or 1Password as your default passkey provider in Settings → Passwords → Password Options, switch back to iCloud Keychain for now — their mobile passkey flows don't yet expose PRF.
Heads-up:if you've set Bitwarden or 1Password as Android's default passkey provider in Settings → Passwords & accounts, switch back to Google Password Manager for now — those mobile flows don't yet expose PRF.
Most Linux laptops don't have a built-in fingerprint sensor surfaced as a WebAuthn platform authenticator. The phone-via-QR or hardware-key paths are usually best.
Authii encrypts each user's master record (the index of the organisations they belong to, their identity record, etc) with a key derived from their passkey via the PRF extension. The server holds only ciphertext for these — even an Authii operator with full database access cannot read them.
For documents you sign in End-to-End-Encryptedmode, the same passkey-derived key is what unwraps the document key. Without PRF, the server would have to hold every user's decryption material — which removes the whole point of the model.
That's why we don't fall back silently: a passkey without PRF would be a quietly weaker product, not the same one. Better to fail loud and tell you exactly what to do.