Your Kanorio account manages your website content, custom domains, team members, and billing settings. The most important principle for account security isn't remembering more passwords—it's ensuring that only you can access the email, Google account, Passkey, and two-step verification required to log in.
1. Why does Kanorio use passwordless login and Passkeys?
Kanorio supports login via Google account, one-time email verification codes (or magic links), and Passkeys. You don't need to set up a traditional password that is easy to forget or reused across other websites:
Reduce the risk of credential stuffing and leaks: You no longer need to remember another password, and you don't have to worry about passwords leaked on other sites being used to access Kanorio.
Phishing-resistant Passkey biometric login: You can add a Passkey in the "Account Settings" under "Login & Security." Afterward, you can log in directly using your phone or computer's fingerprint or facial recognition (Face ID / Touch ID).
Biometric data never leaves your device: Kanorio only stores the public verification key on our servers and never touches or stores your fingerprint or facial data.
Automatic sync when deleting old Passkeys: When you remove a Passkey in your dashboard, the system notifies supported browsers and password managers to hide the old credential, preventing you from selecting an invalid item during future logins.
Protect your login email: Since your identity is tied to your email, if someone gains control of your email or Google account, they may attempt to log in. Please ensure you enable two-step verification for both your email and your Kanorio account. See for Passkey setup steps.
2. Add an extra layer of security with Two-Step Verification (2FA)
Two-Step Verification (2FA) is the most important account protection you can enable. Once active, even if someone obtains your Google login credentials or email verification code, they must also enter the 6-digit dynamic code from your authenticator app (e.g., Google Authenticator, 1Password, Authy) to complete the login (if using a Passkey, the device itself verifies both "possession of the device" and "biometric identity," so no code is required).
Think of it like having two different locks on an office door: the first confirms your login email, and the second confirms that the authenticator device is in your hand.
Store your system-generated backup codes securely in a password manager or in a safe location separate from your phone.
Each backup code can only be used once. The screen will show how many codes remain; when you are running low, click "Regenerate" and enter your verification code to refresh them (old codes will be invalidated).
Never share your QR code, the 6-digit code from your authenticator, or your backup codes with anyone.
3. Identity re-verification for sensitive operations
To prevent unauthorized access if you leave your desk or your computer unlocked, Kanorio uses "Recent Verification Check (Identity Re-verification)" for high-risk operations:
When you add a Passkey, create or rotate API keys, expand existing API key permissions or website scope, or export customer contact lists and store order CSVs, the system will prompt you to re-enter your 2FA code, use a Passkey, or log in again if it has been more than 15 minutes since your last verification.
This check is valid only for your current device, ensuring that every high-privilege credential issuance or bulk data export is authorized by you personally.
4. View and log out of active devices
Under "Account Settings" in "Login & Security → Active Devices," you can see all phones and computers currently logged into your account, including the browser, operating system, approximate location, last activity time, and login time (the device you are currently using is marked as "In use").
Log out a single unrecognized device: If you see an unfamiliar device, click "Log out" on the right side of that row to immediately invalidate that session.
Log out all other devices: If you logged in on a public computer or suspect your phone is lost, click "Log out all other devices" at the top. The system will immediately sign out all other sessions, keeping only the device you are currently using (the system also automatically logs out other devices when you enable or disable 2FA).
5. Recent security activity and notifications
Recent security activity (Immutable audit logs)
At the bottom of "Login & Security," the "Recent Security Activity" section lists your account security history for the last 90 days: including when, from which device, and from which location you logged in, as well as actions like toggling 2FA, regenerating backup codes, logging out devices, linking Google, or adding/removing Passkeys. All records are written to an immutable audit log.
To view website operation logs: This section only records changes to your "personal account" login and security settings. To view website publishing, page and article edits, order processing, or team member changes, please go to "Website Settings › Activity Log" in the left sidebar (see ).
Automated security notifications
Kanorio automatically sends an email to your login address when important changes occur, helping you detect unauthorized activity immediately (these are critical security notifications and cannot be disabled; see ):
Login from a new, previously unused device
A Google login method was added to the account
A Passkey was added or removed
2FA was enabled/disabled or backup codes were regenerated
API key permissions or accessible website scope were expanded
If you performed these actions, you can safely ignore the email. If you did not, please click "Log out all other devices" immediately and ensure 2FA is enabled.
6. Regularly check team member and AI/API access
Principle of least privilege for team members: When managing a website with multiple people, invite each member to use their own account via "Website Settings › Team" and assign appropriate roles (e.g., assign a custom role based on the "Content & Store Editor" template for colleagues editing pages, or the "Order Fulfillment" template for staff handling orders—avoid giving permissions to manage payments, refunds, or website deletion; see for details). Never share login emails. Remove members immediately when collaboration ends or staff leave.
Check API keys and authorized apps: If you have connected AI assistants like Cursor, Claude Code, or ChatGPT, or external automation tools, regularly check "Account Settings › API Access": revoke keys that haven't been used for a long time and disconnect unused authorized apps. See and .
Frequently Asked Questions
Kanorio does not use traditional passwords, so there is no password reset function. You can log in directly using Google, a Passkey, or by requesting a new one-time verification code via email.
This is to prevent automated bots from spamming verification emails or guessing accounts. If a CAPTCHA appears, simply follow the prompts to complete it.
When you log in from a new phone or computer, clear your browser data, or use an incognito window, the system sends a notification. If it was you, you can safely ignore it. If it wasn't, please go to "Active Devices" to log out the unrecognized device and enable 2FA.
First, change and secure the password for the email or Google account you use to log in. Then, log in to Kanorio from a trusted device, click "Log out all other devices," enable or reset 2FA, and check the "Team" members and "API Access" for any unrecognized items. See Security Troubleshooting for detailed steps.
