Re-enrolling a Worker's Passkey

A worker's Workstation passkey can stop working — new device, lost device, or after a one-time identity change. Re-enrollment is the same flow you used to enroll them the first time.

Why it matters

Passkeys are tied to specific devices. A worker who replaces their phone, factory-resets their laptop, or accidentally removes the FabWise passkey from their device's keychain won't be able to sign in to Workstation anymore. Their device's Face ID, Touch ID, or Windows Hello no longer has the credential FabWise expects.

The fix is to generate a new enrollment QR — same flow as the initial setup. The whole thing takes about 2 minutes.

How it works

The worker tries to sign in to Workstation. Their device shows "No passkey found" or "Authentication failed."
The worker tells you they can't sign in.
You go to the user's page in the admin panel and click Generate enrollment QR.
The worker scans the new QR on their device and confirms with their biometric.
The device is re-enrolled. Their next sign-in works normally.

The pending-passkey-enrollment widget on your dashboard lists every worker with Workstation access who doesn't currently have a working passkey. That includes new workers waiting on initial enrollment AND workers who need re-enrollment — both go through the same flow.

Where to find it

Page: Admin Dashboard, or the user's show page
Path: Admin > Dashboard (top of page — Pending passkey enrollment list) OR Admin > Users > (click the user) > Generate enrollment QR
Who can see it: Account admins, on Professional plan

What you'll see

Pending passkey enrollment list (Dashboard)

The list shows every user with Workstation access on but no current passkey. Each row has the worker's name, role, and a Generate enrollment QR link.

If the list is empty, every Workstation-enabled worker has a current passkey. The card is hidden when empty.

Enrollment QR

The QR code page shows:

A scannable QR code
A magic-link URL (for workers without a camera-capable device — they can paste it into a browser)
An expiration time (the QR is good for a short window)

Send the QR or link to the worker. They open it on their device, confirm their identity with Face ID / Touch ID / fingerprint / Windows Hello, and they're re-enrolled.

What to do

Open their user page.
Check Workstation access is still on. If it isn't, turn it on.
Check the user is on a Professional plan account. If you've downgraded recently, that's why — re-upgrade to restore Workstation.
Click Generate enrollment QR.
Send the QR to the worker. They scan, confirm, and they're back in.

A worker got a new device

Same flow as above. Their old device's passkey is dead (the credential lives in the device, not on FabWise's servers — when the device goes, the credential goes). Generate a new QR for the new device.

A worker has Workstation on multiple devices

Each device gets its own passkey. You can generate enrollment QRs for the same worker as many times as you need — each enrollment adds a new passkey for that device.

A worker doesn't show up in the pending list

If a worker has a current passkey, they don't appear in the pending list — that's expected. If they say sign-in isn't working but they're not in the list, the issue isn't passkey-related. Check:

Is the user Deactivated? Reactivate them.
Is the account on Starter? Upgrade to Professional.
Is Workstation access turned off? Turn it on.

Common questions

Will the worker lose their data when I re-enroll them?

No. Their shifts, tasks, and history stay attached to their user. The passkey is just how they sign in.

Can I do this in bulk?

No bulk re-enrollment. Each worker confirms on their own device — there's no way to skip that step (that's the whole point of passkeys: they're bound to a physical device, not transferable). For a large account, plan a re-enrollment session where workers come to you one at a time with their device.

What if a worker can't get their device to scan the QR?

Use the magic-link URL instead. Copy the URL from the QR page, send it to the worker via text or email, and they open it directly in their device browser. Same enrollment flow.

[Enrolling Workers for Workstation](enrolling-workers-for-workstation.md)
[Understanding app access toggles](understanding-app-access-toggles.md)
[Managing Users](managing-users.md)