02 / Passwordless sign-in
Your device approves. The website verifies.
An independent passwordless first factor for participating websites and applications. One familiar sign-in experience, without a site-specific password. Rhea Data is not required.
Your device approves. The website verifies.
01 / Participating website
A fresh request, for this site.
shop.example
Scan the fresh QR request with Rhea Key
42
02 / Your Rhea Key device
Scan, match and approve.
42Confirm the same two digits, check which site is asking, then approve on your device.
03 / The website backend
Verify the response. Start the session.
The device returns a signed response. The website checks its challenge, binding, expiry and signature, rejects reuse, then creates its own session.
Rhea Data is not required.
The everyday story
One familiar way to sign in.
Remembering passwords and old sign-in details adds friction. Rhea Key replaces the password on participating sites with a fresh request and approval on your device.
The old way
Which password? Which email?
- Site A · one password to remember
- Site B · a different sign-in email
- Site C · another password reset
With Rhea Key
One familiar sign-in.
A website or application must integrate Rhea Key to offer this sign-in experience.
On desktop: select Rhea Key, scan the fresh QR request, match the two digits and approve. Supported mobile flows open Key directly. The website verifies the cryptographic response and creates its own session.
Definition
Precisely what Rhea Key is, and is not.
It is
A first factor
“First factor” means the primary way you sign in: Key replaces the password rather than adding a step after it. It signs you in; it does not verify your legal identity.
It is not
A password manager
There is no store of shared secrets to fill in. The goal is fewer secrets, not better-stored ones.
It is not
A crypto wallet
Rhea Key uses cryptography for authentication and approval. It does not hold, send or trade digital assets.
Two moments
Sign in once. Authorize a connection deliberately.
Signing in and approving a connection are different moments. Connecting an assistant to Rhea Data needs its own explicit approval, limited to read-only organization metadata in this example; routine permitted work does not repeat the sign-in flow, though sensitive actions may ask again.
Passwordless sign-in
- Proves control of the sign-in key to the site that asked.
- Bound to that site and a one-time challenge, helping protect against reuse on another site.
- The site verifies the proof before creating its session.
Connection · limited permissions
- Authorize an assistant connection once, with a defined read-only metadata scope.
- Shows who is asking and exactly what for.
- Review logged activity and disconnect to stop further access; this cannot undo prior actions or disclosures.
For the technically curious
Desktop asks. Your device approves.
The website, your device and the website’s server each have a job. Open the detail to see every message.
How the website verifies the sign-in
Example sign-in flow
Step 1 / 6
Desktop
Website
Phone
Rhea Key
Site server
Verifier
Sign in. The visitor selects “Continue with Rhea Key” on a website.
Getting started
Set up once. Use it everywhere it’s supported.
Create your key
Follow the supported setup to create and control your cryptographic sign-in key on your device.
Plan for another device
Follow the supported device-linking and recovery flow before relying on another device.
Sign in and approve
Use Rhea Key on participating sites; authorize assistant connections explicitly and manage their access.
Device setup and recovery follow the supported product guidance; adding a device is not an automatic recovery guarantee.
Design principles
Built to be trusted with the front door.
- 01
Your key. Your approval.
Device-held cryptographic keys approve sign-in. The private key is not sent to the website; setup and recovery follow the supported product flow.
- 02
Fresh, site-bound requests
Signatures are bound to the requesting site and a one-time challenge, not to a reusable secret.
- 03
Recovery you control
Restore your key on a new device with your 12-word recovery phrase, guardian slips or a sealed backup file. Rhea cannot restore a lost key.
- 04
Independent of any platform
Authentication as neutral infrastructure — not a feature that ties people to one ecosystem.
- 05
One unified mode
The same product for everyone. No separate consumer and enterprise editions.
For developers
Easy to add to your website. Verified on your server.
Participating websites can add the Rhea Key RK-1 button with two lines of HTML—no Rhea Data integration or Key API key required for this frontend. The site still implements its own single-use challenge, backend verification and session. OIDC is an alternative for registered clients.
Add Key to your website<script src="https://rheakey.com/sdk/rhea.js" async></script>
<rhea-button app-name="Your Website"></rhea-button>Rhea Key has a single, unified user mode.
Rhea Key is not a crypto wallet and not a password manager.
Continue
Add passwordless sign-in to your website.
Developers can start with RK-1 or registered OIDC. Business teams can review integration, security and procurement requirements.