Exchange is excluded from this API/CLI release. Any historical Exchange API or CLI example in this guide is unavailable; native portal behavior is outside this exclusion. See current release scope.

Signing in with passkeys

Binadit now uses passkeys for portal accounts. Username/password login and password resets are no longer available. A passkey uses your device's fingerprint, face recognition or screen-lock PIN. Binadit never receives that fingerprint, face or PIN.

Already have a passkey?

Open the portal login. Your browser tries to find a passkey immediately. Choose your Binadit passkey and follow your device's instructions. If you cancel, the Sign in with a passkey button lets you try again. You can use a synced password manager, another device or a compatible security key.

After signing in, the same valid passkey session covers ordinary portal actions. You do not need to confirm your passkey again for every change.

Previously used a password?

Choose No passkey yet? Start here on the login page.
Enter the email address already registered for your account. Every address gets the same next screen.
Under Already had an account with a password?, enter your current Binadit password once. Only after the password is confirmed do we email your setup link. Entering the address alone sends nothing for an existing account without a passkey; this stops someone who only controls your mailbox from taking over the account.
Open the personal link in your email and choose Create my passkey. The link is valid for 30 minutes. Once setup starts, finish in the same browser.
Save the passkey and complete your device's verification. If you already had an authenticator app, enter its current six-digit code during this one-time migration to retain your existing protection.
You are signed in to your existing account. Your companies, products and permissions are retained. Complete any missing profile information.

This applies equally to account owners, team members and Binadit administrators. A wrong password, an unknown address and an account that cannot be used all give the same message. After five wrong attempts for one address, or fifteen from one network, within an hour, the step is locked for up to an hour; the message does not say whether the address or the password was wrong.

Never had a password, or forgotten it? Passwords can no longer be reset. Team members (including people added by a colleague who never chose a password) ask an owner or administrator of their company to send a new setup link from the Team page (Reset passkeys). Account owners, administrators and people who belong to several companies contact Binadit support for identity recovery. A team invitation link that has not expired keeps working without a password only for an address that has no account yet. If the invited address already has an account without a passkey, the invitation sends you to the password step above first; after your first passkey is created you accept the invitation signed in. An invitation can come from any company, so it does not replace the password for an existing account.

Setup links that were emailed before 10 November 2026 remain valid until they expire.

Do not create a second account using a different email address. If you no longer control the registered mailbox, contact support for identity recovery.

New customer

Choose Create an account, enter your email, and open the setup link. No password or personal details are requested before email confirmation. Clicking Create my passkey starts account creation; simply opening the email link does not create an account or sign you in. This prevents email security scanners from using your link.

After creating your passkey, complete your name and account details in the portal. Account owners supply the necessary customer details. Team members supply their personal details and do not create a separate customer company.

Team invitation or welcome email

An invitation retains the company and permissions selected by its administrator. Follow the link and continue. If you already have a passkey, sign in with that passkey before accepting. Otherwise, create your first passkey and then complete your details. A welcome link from a Binadit administrator also leads to passkey setup; it no longer asks you to choose a password.

Another computer or a lost device

A synced passkey may already be available through your password manager. You can also use another device or a security key. While signed in, open Account → Security and add a second passkey as a backup. You must add a replacement before removing your last passkey.

An email link cannot replace a passkey on an already protected account. If all your passkeys are lost, contact your company owner or Binadit support for verified recovery. A company owner can use the existing restricted team recovery for an eligible member. This revokes the old keys and sends a new setup link; it cannot take over an administrator or an identity shared with another company.

Never send a passkey, setup link, password-manager export, authenticator secret or recovery code to support or an AI agent.

API and CLI

binadit auth login opens the same portal sign-in. Create your first passkey before starting CLI authorization if you still need to migrate. Then sign in, select the company and approve only the required scopes. If enrollment or profile completion outlasts the CLI's callback timeout, complete setup and run binadit auth login again.

Each computer can have its own CLI connection; passkeys authenticate the person while OAuth tokens authorize that connection. Existing company permissions, scopes, expiry and revocation rules remain in force. First-passkey migration changes the identity generation, so old personal connections may need a new login. There is no username/password OAuth grant.

For administrators and AI agents, use send-setup-email for an eligible identity without a passkey. set-password and send-password-reset-email are retired and return password_login_removed; they are no longer advertised as supported operations. Mailbox and hosting passwords are separate service credentials and are unaffected.

Troubleshooting

No email: check spam, verify the address and wait two minutes before requesting another link. Already a customer without a passkey? You only receive the link after confirming your current password. The public response intentionally does not reveal which addresses are registered.
Password not accepted or locked: check the address and password, or wait for the stated number of minutes. Ask your company owner/administrator or Binadit support for a new setup link if you cannot prove your password.
Expired or already used: request a fresh link. Old password-reset links do not restore password login.
Started in another browser: continue in that browser or request another link. Do not forward the link.
Browser not supported: use an up-to-date browser on a phone or computer.
Already protected: use your existing passkey or verified recovery. Requesting more email links cannot overwrite your credentials.