Sign-in and Passkeys

Use this guide to create an email account, sign in again, or manage your sign-in credentials. A passkey lets your browser or device confirm your identity; the device prompt varies between browsers and devices.

Before you start

Use an email address you can access. Have a browser/device that supports passkeys available for setup. If an administrator already created your account, use their instructions and verification email rather than registering a second account.

Google sign-in is a separate option on the sign-in page. Apple sign-in appears only when configured for the installation.

Create an email account

1. On the sign-in page, choose Create an account.
2. Enter your email address and accept the displayed consent.
3. Open the confirmation email and follow its validation link.
4. On Set up your passkey, choose Create passkey.
5. Complete the browser/device prompt.

Result: after successful setup, the application opens with your account signed in. A self-registered account may start in the demo license; ask your restaurant administrator about account transfer and access to your restaurant.

The registration form does not ask you to choose a password.

Sign in again

1. Enter your email address on the sign-in page.
2. Select another part of the page or press Tab to leave the email field. This loads the methods available for that account.
3. Choose Sign in with passkey.
4. Complete the browser/device prompt.

Result: successful authentication signs you in. If no passkey button appears, use the troubleshooting table below. A password field appears only for an account with a password.

Replace an existing password with your first passkey

This applies when you sign in with a password and the application requires passkey setup.

Your existing password will stop working

For a password account without Google/Apple sign-in, registering the first passkey disables that password. Set up a credential you will be able to use for future sign-ins. If you cannot finish on the current device, choose Logout before starting setup.

1. Sign in using your existing email and password.
2. In Set up your passkey, choose Create passkey.
3. Complete the browser/device prompt.
4. Continue into the application.

Result: use the passkey for future sign-ins. The old password is no longer the fallback for this account.

Add another passkey

If this is the first passkey on a password account without Google/Apple sign-in, the password-change warning above also applies.

1. While signed in, open the avatar/user menu in the top bar.
2. Choose Passkeys.
3. Choose Add passkey and complete the browser/device prompt.
4. Check that a new entry appears in the list.

Entries are identified by creation date. Note which entry you just added; the list does not show friendly device names.

Remove an old passkey

Keep a usable sign-in method

Add and verify a replacement before removing a credential you still need. OrderNow rejects removal when it would leave no sign-in method, but it may allow the last passkey to be removed when another method is connected to the account.

1. Open the user menu and choose Passkeys.
2. Identify the old entry by its creation date.
3. Choose Remove passkey for that entry.
4. Check that the intended entry disappears and the replacement remains.

This removes the credential from the OrderNow account. Managing the saved copy in your device's credential settings is a separate task.

Accounts managed by Google or Apple show a gold outline around the avatar in the upper-right corner and an OAuth account label in the open account menu. The users overview also labels these accounts with a gold-outlined OAuth account badge beside the username. The Passkeys option is hidden for these accounts; manage sign-in credentials and recovery with your provider.

Prepare account recovery

If you sign in with Google or Apple, use that provider’s account-recovery process. OrderNow does not issue local recovery codes or replace provider sign-in with an OrderNow passkey for these accounts. A passkey used at Google or Apple belongs to that provider’s authentication flow.

Recovery must be prepared while you can still sign in. When your installation enables this feature:

1. Open Passkeys from the user menu. Add a passkey first if you normally use a connected provider.
2. Under Prepare account recovery, choose Send setup confirmation email.
3. Copy the confirmation code from your account email into Confirmation code from email within 15 minutes.
4. Choose Verify passkey and create recovery code and complete the fresh passkey prompt.
5. Save the displayed offline recovery code securely, separately from your passkey device and email account. Confirm that you saved it before closing the dialog.

The code is displayed once and cannot be retrieved later. Creating another code invalidates the previous code and pending recovery attempts. You receive a security notification. Never send your code to an administrator or support.

Recover after losing all sign-in methods

You need both your saved offline recovery code and access to your verified account email. Email access or administrator approval alone is insufficient. Recovery cannot unblock a blocked account.

1. On the sign-in page, choose Recover account. If this control is absent, ask the installation operator whether recovery is enabled.
2. Enter your account email and choose Send recovery instructions. The acknowledgement is the same whether recovery is available or not.
3. Check your email and spam folder. Open the link within 15 minutes in the browser where you requested recovery.
4. Check that this browser supports passkeys before submitting your saved code. Choose Verify recovery.
5. Within five minutes, choose Create replacement passkey and complete the device prompt.
6. Choose Confirm replacement and complete recovery and authenticate with the replacement passkey.
7. Save the new offline recovery code, confirm that you saved it, and return to normal sign-in with the new passkey.

Recovery replaces account access

Successful verification consumes the email token and your saved code once. If you lose the recovery browser session before completion, the consumed code cannot start another recovery. Complete the replacement in that browser before it expires.

Completion removes all previous passkeys, passwords, pending account capabilities, and staff sessions. Account roles, restaurant/location assignments, guest sessions, and integration sessions are preserved. Security notifications are sent to the account email.

Without a previously saved code, or without access to the verified inbox, this self-service procedure is unavailable. Contact support to discuss options. Support cannot bypass ownership verification, and creating a new account does not restore the old account's access or information. Password reset cannot restore an established passkey or connected-provider account. The reset button displays an acknowledgement directly on the sign-in page. Only eligible password accounts receive a reset link; check the spam folder and use it within 15 minutes. Google/Apple users recover at their provider, and OrderNow passkey users follow the recovery procedure above. If the request fails, the page displays an error and allows another attempt.

If you cannot sign in

What you see	What to check	Next action
No passkey button	Email address, whether you left the field, and any browser-support notice	Correct the address and leave the field. Use a supported browser if the page reports a support problem.
A canceled prompt or sign-in error	Whether the required credential is available to the browser/device	Start sign-in again and complete the prompt with an available credential.
The password field is missing	Whether the account uses passkeys instead of a password	Try the offered passkey or an already connected sign-in provider.
No usable credential	Another connected method, or your saved recovery code and verified email	Use the connected method or follow the recovery procedure above.
Invalid/expired/used recovery link	Original browser, link age, and saved code	Start again if your saved code has not been consumed. Otherwise contact support; it cannot bypass verification.
Too many recovery attempts	The cooldown message	Wait one hour before retrying. Normal sign-in remains available.
Canceled passkey prompt	Whether the five-minute recovery session is still valid	Retry the current step before expiry.
An expired confirmation link	The error shown after opening the email link	Ask the restaurant administrator to arrange help with account verification.
A blocked-account notice	Account access status	Ask the restaurant administrator to review access in Users.

When asking for help, provide the sign-in method, device/browser, time, and displayed error. Share your account email privately when the administrator needs to identify it. Never send passwords, session keys, or passkey credential details. Never share email recovery tokens or offline recovery codes. An administrator can review blocked access but cannot authorize recovery on your behalf.