Security
Approvals and passkeys
Your approval passkey, which actions need it, approving from the panel, and adding a second device.
The approval passkey
When you create your account, Zefily asks you to register an approval passkey — a passkey on your phone, laptop or security key. It is held by Zefily's separate signing service, not by the panel, so even someone with your panel session cannot approve risky actions without your device.
Manage it under Settings → Approvals:
- Register approval passkey: the first one is registered directly, and you get an email when it is added.
- Add another approval passkey: keep a second one on another device so losing one does not lock you out. Your current passkey approves the new one first (up to five).
What needs approval
| Action | Where |
|---|---|
| Root terminal, or a sudo user's | Terminal |
| Commands, cron entries, daemons and recipes that run as root or a sudo user | Cron, Daemons, Recipes |
| Rebooting a server | Reboot |
| Opening a database or cache port to everyone | Firewall |
| SSH keys, sudo and deleting server users | Users |
| Deleting a site with its files, a database, or restoring a backup | Sites, Databases, Backups |
| Importing a database dump | Databases |
| Switching the web server | Web stack |
| Custom nginx directives | Site → nginx |
| Removing the agent | Overview |
Approving
When an action needs approval, the panel shows Approve with passkey next to it (and on the server's Activity). Click it and confirm on your device; the job then runs. Approvals are tied to that one job on that one server and expire after a short time.
Each approval is emailed to you from the signing service. If you get an approval email you did not expect, change your password and passkeys and contact support.
Losing your passkey
If you lose your only approval passkey, contact support: recovery is deliberately slow and verified through several channels, so nobody can take over your approvals quickly.
Updated October 18, 2026