# Approvals & passkeys Paybox authenticates every protected request with **two factors**, verified statelessly: * **Email** — a live MoonX session (access token). Proves account ownership. * **Passkey** — a WebAuthn assertion, surfaced as a **presence token**. Proves a human is present on a trusted authenticator. ## Two tiers | Tier | Used for | Requires | | --- | --- | --- | | **Read / session** | viewing credentials, clients, approvals, audit | a valid (unexpired) passkey presence token | | **Step-up** | revealing secrets, signing, issuing/revoking keys, approving | a **fresh** passkey assertion (within a short step-up window) | So browsing rides one assertion for its lifetime, but any high-value operation forces a fresh passkey touch. ## Approval flow When an agent requests something that needs sign-off, Paybox creates a **pending approval**. On mobile you get a push notification; tapping it opens a focused approval screen. Approving drives a passkey/biometric step-up. Approvals are **operation-bound**: change a parameter (amount, merchant, payload) and it's a new request — an approval can't be replayed against different operation details. :::warning A removed passkey can't be restored from email alone. If you remove your only passkey, the account is locked for security. Keep a passkey on a second device. :::