Setting up your sign in happens once. It takes a few minutes, it cannot be postponed, and at the end of it your daily sign in is a single touch of a fingerprint reader. This article is the walk through, and it is also the one to come back to when you change laptop or lose a phone.
Your first sign in
When somebody at your property creates your account, Prostay emails you to say the account exists and what it is for. That email carries no link to click, and that is on purpose rather than a fault.
So go to the sign in screen, type your email, and use Email me a sign-in link. Open the link on the device you intend to work on, because the passkey you create at the end of setup belongs to whatever device you finish on. Finishing setup on your phone and then sitting down at a desktop means doing the passkey step again.
The three steps
Opening the link brings you to a screen headed Set up this device, and from there Prostay asks for three things in order. You cannot skip any of them and you cannot reach the rest of the application until they are done. If you close the browser part-way, the next sign in link picks up where you stopped.
| Step | What you do | Why |
|---|---|---|
| 1. Authenticator | Scan the Authenticator QR code with Google Authenticator, Microsoft Authenticator or any similar app, then type the six digit code it shows. If the camera will not cooperate, Cannot scan? Enter this key in your authenticator app gives you the same thing as text. | It is what proves it is you when you sign in somewhere new, and it works with no signal. |
| 2. Backup codes | Prostay shows a set of one time codes. Save them somewhere that is not the phone holding the authenticator app, then confirm with I have saved these codes. | They are the way back in if the phone is lost, broken or wiped. |
| 3. Passkey | Create a passkey on this device, then approve the prompt your browser raises and give the passkey a name. | This is what makes every sign in from now on a single touch. |
Name the passkey after the machine rather than after yourself, because you will eventually have several and the list is the only way to tell them apart. The screen says as much: a name helps you tell a phone, a laptop and a security key apart. "Front desk iMac" is useful in six months and "My passkey" is not.
Backup codes, and why they matter
Prostay shows your backup codes once, at the moment it generates them. After that your profile will tell you how many are left but never what they are, because they are stored scrambled and Prostay genuinely cannot read them back. Nobody at your property can look them up for you either.
Each code works once. Prostay warns you when you are down to two remaining, and you can generate a fresh set at any time from your profile, which immediately kills the old set. Put them somewhere you can reach without Prostay and without the phone: a password manager on a different device, or paper in a locked drawer. A screenshot on the same phone as the authenticator app protects you from nothing, because the single realistic disaster is losing that phone.
Signing in on a new device
How much you have to do depends on where your passkey lives, and that is decided by your phone or computer rather than by Prostay.
| Situation | What happens |
|---|---|
| Your passkey syncs through iCloud, Google or a Windows account, and the new device uses the same account | Nothing to do. Type your email, use the passkey, approve the prompt. |
| The new device is signed in to something else, or the passkey does not sync | Type your email and use Email me a sign-in link. Prostay asks for an authenticator code, then offers to create a passkey on this device too. |
| A machine you will use once, like a colleague's laptop | Use the sign in link and do not create a passkey. Leaving one behind means that machine can sign in as you. |
| A machine with no fingerprint reader or face camera | Your phone can approve it. The browser offers a QR code, you scan it, and the phone answers on the desktop's behalf. |
When you have lost the device
Work from another machine and use whichever of these still applies, in order. The first one that works gets you in.
- The phone is gone but you have your backup codes. Ask for a sign in link, choose Use a backup code instead, and type one. You are in, and the code you used is now spent.
- The laptop is gone but the phone is fine. Ask for a sign in link and use an authenticator code. Then remove the lost laptop's passkey from your profile.
- Both are gone, or the codes went with the phone. Nothing you hold can get you in, which is the point of the design. Ask an administrator at your property to reset your sign in.
Managing all of this later
Everything above lives in one place afterwards: your profile, on the Security and sign-in tab.
| What is there | What it does |
|---|---|
| Your passkeys | Every device that can sign in as you. Rename one, or remove one you no longer use. Prostay will not let you remove the last one, because that would lock you out of your own account. |
| Add passkey | Enrols the device you are on right now. This is how a second laptop gets added. |
| Backup codes remaining | A count, never the codes. Create new codes issues a fresh set and retires the old one. |
| Change email | Changes the address you sign in with. Prostay asks for an authenticator code and then sends a confirmation to the new address, so a mistyped address cannot lock you out. |
| Sign out everywhere | Ends every session on every device immediately. Worth doing after a lost phone, or after signing in somewhere you should not have. |
What an administrator can do
Administrators cannot see or set anybody's passkey, authenticator or backup codes. What they have are two blunt instruments, on Users then editing a person.
| Action | What it does | When to use it |
|---|---|---|
| Resend invite | Sends a fresh sign in link, good for twenty minutes. Changes nothing about the account. | Somebody cannot find their email, or their link expired and they would rather be handed one. |
| Reset sign-in | Clears the authenticator, every passkey, the backup codes and the remembered devices, then emails a new setup link. Every existing session stops working at once. | Somebody is locked out for good, or an account may be in the wrong hands. |
Reset sign-in is the equivalent of the old password reset and it is deliberately heavy handed. The person starts again from the three steps at the top of this article, on whatever device they are holding.
Where to go next
- Signing in without a password, for the everyday sign in once setup is behind you.
- Shared front desk computers and PINs, if your staff do not carry phones.
- Users, roles and permissions, for creating the account in the first place.