From passwords to passkeys: how sign-in and trust grew with TradeYoke
A system that holds a business's customers and invoices has to be hard to break into. Here is how TradeYoke's sign-in grew, and what is live in the web browser today.
Part 38 of 39 of Building TradeYoke, the story of how the platform was built, from January 2024 to today. Previous: From a 2019 idea to today: the whole TradeYoke journey. Next: The TradeYoke build timeline: every part of the build, in order. See every part on the build timeline.
Quick answer
Quick answer: TradeYoke's sign-in has grown in steps: it began with email and password, added Sign in with Google and optional two-factor authentication, then passkeys, and in October 2026 became passwordless. You now sign in with Google, Apple or Microsoft, an emailed six-digit code or link, or a passkey, and TradeYoke holds no passwords at all. Passkeys in the Android, iPhone and Windows apps are coming shortly; the apps themselves are in pilot.
Key takeaways
- Sign-in is now passwordless: Google, Apple, Microsoft, an emailed code or link, and passkeys. TradeYoke holds no passwords.
- Two-factor authentication can be required of everyone in a workspace.
- Permissions on every action and an audit trail sit behind the sign-in.
- Passkeys for the apps are coming shortly; the apps are in pilot.
Why sign-in matters more than it looks
From the moment TradeYoke held invoices, the sign-in was the lock on the shop door. A stolen login could mean a changed bank detail on an invoice, which is exactly the kind of fraud that hits small businesses. So as the product grew, so did the effort we put into who can get in.
The steps
- Email and password. The starting point, with a proper account for each person. Sign-ins are not shared. Retired in October 2026; see the last step.
- Sign in with Google. For people who would rather not manage another password. Our article on signing in with Google goes through it.
- Two-factor authentication. An extra code on sign-in, which a workspace can require of everyone. It follows the person, so it is checked whichever way they sign in.
- Permissions and an audit trail. Behind the sign-in, every action is controlled by a permission, and a trail records who did what. Nobody can give someone more access than they have themselves, and nobody can edit their own roles.
- Passkeys. Live in the web browser since October 2026.
- No passwords at all. The newest step, in October 2026: Google, Apple, Microsoft, an emailed code or link, and passkeys all lead to one TradeYoke account, and people add or remove ways to sign in under My account.
What a passkey is
A passkey is a way of signing in with something you have, your phone or computer, unlocked the way you already unlock it, instead of a password you type. There is no password to guess, phish or reuse. Passkeys: sign in without a password is the longer explanation.
What is live, and what is not
Passkeys are live in the web browser. Passkeys in the Android, iPhone and Windows apps are coming shortly, and the apps themselves are in pilot and not yet in the app stores. We would rather tell you what is not finished than let you assume it is.
The thread running through the build
Every year of the build added something worth protecting: customers in 2024, money in 2024 and 2025, locations in 2025. Each time the sign-in had to be at least as strong as the thing behind it. That is also why we wrote the terms and privacy notice so early.
Questions people ask
Can I sign in to TradeYoke without a password?
Yes. TradeYoke has no passwords: you sign in with Google, Apple or Microsoft, an emailed code or link, or a passkey. Passkeys in the Android, iPhone and Windows apps are coming shortly.
Can my whole team be required to use two-factor sign-in?
Yes. A workspace can require two-factor authentication of everyone.
Try it on your own week
30 days of Essentials free, no card. Bring your customers and see it against a real week.
