Signing in on another device

Your existing signed-in browser creates an authenticated, single-use invitation. Its QR carries a server-generated 8-character locator and a separate 256-bit capability to the joining browser; a locator alone cannot join. The joining browser supplies a one-time public key, then your existing browser encrypts recovery material so only that one-time key can open it. The joining browser re-derives your identity locally and checks it against the registered genesis evidence.

The relay is designed to hold encrypted pairing material rather than a plaintext recovery phrase. Security still depends on both endpoints, the one-time token and your fingerprint comparison remaining trustworthy.

Both devices show the same short fingerprint before you approve. Comparing them is what lets you detect a substituted one-time key. If they differ, stop and cancel the pairing.

Pairing gives that browser the ability to derive and use your signing key. Anyone who controls it may be able to sign as you. Do not pair a shared, public or unmaintained device. Compatible authenticators protect keys where available; browsers without the required passkey capability use the clearly identified passphrase-encryption fallback.

If a device is lost, Provenance has no per-device switch today. The device list on your account page is fed by a store that has been retired, so there is nothing there to revoke. The remedy is to rotate your key where your identity was created — in Parable, that is Settings › Security — which retires the old key everywhere immediately: every Ma’atara service refuses the old one on its next request. Anything signed while the device was trusted stays valid, which is correct: that work genuinely was yours at the time.

A newer flow is built and switched off for this product: instead of moving recovery material through a relay, a new browser generates its own key locally and asks the identity portal, where your root key lives, to approve it — no phrase involved, and removing a device becomes something the server refuses on the next request rather than something the removed device has to notice. It needs an identity minted at the portal; an identity created in Parable keeps using the pairing above until its owner moves it there. Until the flag is on here, pairing works the way this page describes.