Credentials
Add, change or remove sign-in methods
People enroll passkeys, authenticator apps and other methods allowed for their persona, and set up recovery.
Dashboards / Every user
Customer Dashboard
Every user gets the Customer Dashboard. It is where people manage their own credentials, profile, API keys and communication methods, see their sessions, raise support tickets and request activation or deactivation of their account.
Available now in WebFrolic.
Why it matters
Every password reset you handle by hand is a social-engineering opportunity.
When people cannot update a phone number, add a passkey or end a stolen session themselves, they call support, and support becomes the weakest step in recovery. Self-service with the right checks is both cheaper and safer.
API keys
Keys that act as you
Personal API keys carry only the permissions the person selects, with an expiry, and can be revoked at any time.
Account control
Sessions, activation and deactivation
People see where they are signed in, end sessions they do not recognize, and request deactivation or reactivation.
What is on it
Everything a person manages for themselves.
| Area | What people can do | Why it helps |
|---|---|---|
| Profile | Update name, contact details and the profile attributes their persona collects. | Records stay current without admin edits. |
| Credentials | Enroll, replace or remove sign-in methods; set up recovery. | Lost devices do not become help desk calls. |
| Communication methods | Choose where codes and notices go, and confirm them. | Codes reach a verified destination. |
| API keys | Create personal keys with selected permissions and an expiry; revoke them. | Integrations stop borrowing passwords. |
| Sessions | See active sessions and end any they do not recognize. | A stolen session can be closed in seconds. |
| Support | Raise a customer support ticket and follow it. | Requests reach the right desk with context. |
| Activation and deactivation | Request deactivation of the account, or its reactivation. | Leaving is self-service and reversible by an administrator. |
Before rollout
Questions worth answering.
Settle these first and the rollout is mostly configuration.
- Decide which authenticators each persona may add from the dashboard.
- Require re-authentication with an existing factor before credential changes.
- Decide whether customers may create personal API keys, and with which permissions.
- Agree how long a deactivated account is kept before deletion.
- Check that every self-service change is audited.
Related capabilities
Explore what connects to this.
These capabilities are usually configured together.
Evaluate with your scenario
Start with a concrete workflow.
Share the identities, resource boundary and decision you want to test. The walkthrough can focus on the relevant behavior rather than a generic feature tour.