A person who signs in with a passkey cannot recover or reset their password #15

New issue

Open

opened 2026-11-04 23:15:09 +00:00 by jmoran · 0 comments

jmoran commented

2026-11-04 23:15:09 +00:00

Owner

An owner who signs in only with a passkey has no way to learn or reset their password. Git over HTTP then stops working for them.

What happened

The owner signed in with a macOS passkey and never kept the password.
git push http://localhost:3000/... asks for a username and password, and fails with could not read Username.
/settings/password asks for the current password before it sets a new one.
No admin or CLI reset exists, and macOS does not reveal a password behind a passkey.

What would fix it

A signed-in owner whose session came from a passkey can set a new password without the old one.
An admin can reset another person's password, or send them a one-time reset link.
An operator command, run on the forge's own host, resets a password.
The git login prompt says that a token or an SSH key from /settings/keys works in place of a password.

Workaround today

While signed in with the passkey, add an SSH key at /settings/keys, then push over SSH on port 2222.

Seen on forge-jay main at 3fc29acb, 2026-11-04.

An owner who signs in only with a passkey has no way to learn or reset their password. Git over HTTP then stops working for them. ## What happened - The owner signed in with a macOS passkey and never kept the password. - `git push http://localhost:3000/...` asks for a username and password, and fails with `could not read Username`. - `/settings/password` asks for the current password before it sets a new one. - No admin or CLI reset exists, and macOS does not reveal a password behind a passkey. ## What would fix it 1. A signed-in owner whose session came from a passkey can set a new password without the old one. 2. An admin can reset another person's password, or send them a one-time reset link. 3. An operator command, run on the forge's own host, resets a password. 4. The git login prompt says that a token or an SSH key from `/settings/keys` works in place of a password. ## Workaround today While signed in with the passkey, add an SSH key at `/settings/keys`, then push over SSH on port 2222. Seen on forge-jay `main` at `3fc29acb`, 2026-11-04.

jmoran referenced this issue from a commit

2026-11-05 21:28:00 +00:00

Let a passkey session set a password without the old one (#15)

jmoran referenced this issue from a commit

2026-11-05 21:28:00 +00:00

Let an admin set a person's password or make a one-time reset link (#15)

jmoran referenced this issue from a commit

2026-11-05 21:28:00 +00:00

Add --reset-password, the operator's password reset on the forge's host (#15)

jmoran referenced this issue from a commit

2026-11-05 21:28:00 +00:00

Say what works in place of a password when git over HTTP is refused