# Sign in with a passkey or a code

Sign in with a passkey, or with a code Rookery emails you. When your address's mail comes into Rookery, codes go to an address of yours outside it.

Staying safe · Updated October 18, 2026 · https://userookery.com/help/sign-in/

Rookery signs you in with a **passkey**: your fingerprint, face or device PIN. Add one in **Settings → Your account → Passkeys**. On a device without one, click **Email me a code** and enter the 6-digit code Rookery sends. A code works for 10 minutes and allows 5 tries.

## When your address's mail comes into Rookery

Rookery never emails a sign-in or invite code to an address whose mail comes into Rookery: an inbox like `hello@`, an alias, an address elsewhere (like a Google Workspace or Microsoft 365 address) that forwards its mail into an inbox here, an inbox's send-as address, or any address on a domain you've connected to receive mail. A plus address like `hello+rookery@` counts too, because its mail goes to `hello@`. A code there would land in Rookery, where it wouldn't be only yours to read.

So if you sign in as one of those addresses (the owner as `hello@`, say), Rookery sends your codes to an address of your own outside Rookery instead, like your personal email:

1. Go to **Settings → Your account → Sign-in codes**.
2. Type the address and click **Send a code**.
3. Enter the code that arrives there and click **Confirm**.

Until you do, **Today** shows **Add an address for sign-in codes**, and Rookery sends no codes for your address: you sign in with your passkey. It shows up as soon as you connect a domain that makes your address one whose mail comes into Rookery. It also shows when Rookery knows your address's domain only from its inboxes, for example after the domain is removed from Rookery while its inboxes stay: mail to that domain may still arrive here.

The code page never says whether an address has an account, an invite to sign up, or mail that comes into Rookery. Signing in, it always says: if there's an account, the code went to its address, or to the address it uses for codes. Signing up, it always says: if you can sign up with that address, the code went there. Already have an account? Then it went where your sign-in codes go and signs you in. No code? Sign in with your passkey. Only an invite to join a team names where its code went.

## Joining a team

When you're invited at an address whose mail comes into Rookery, the invite page asks **Where to send your codes**. Your code to join goes there, and so do your sign-in codes from then on. You can change it in **Settings → Your account → Sign-in codes**.

Nobody can be invited at an address that's already an inbox or an alias, like `support@`: whoever signed in as it could take the inbox over.

## If a code email comes back

Code emails carry a stamp only your Rookery can make. If one ever comes back in, for example in a bounce, Rookery sets it aside where nobody in the workspace can open it, and deletes it once the code has run out. It never shows in an inbox or under **Held mail**, and the code is never in the subject.