Short answer: yes. DripTell supports passkeys for personal sign-in, so a team does not need to circulate one workspace password. An owner can also require two-factor authentication, review trusted devices and active sessions, and limit what each named member can do. Those are separate controls, and that distinction matters.
Replace the shared password first
A shared login hides responsibility. When three agents use the same credential, an owner cannot confidently connect a session to one person, remove only the leaver, or know whether an unfamiliar device belongs to the team. Password rotation also interrupts everyone at once.
Give each teammate a named account in the shared inbox. Decide which channels, contacts and actions that role genuinely needs. A temporary contractor may need one queue but not workspace settings. A supervisor may need assignment and review rights without API-key access.
Know what a passkey changes
A passkey is a credential created for a particular account and service. The private part remains protected by the user's device or password manager and is unlocked with the device method, such as a fingerprint, face check or PIN. The service stores a public key rather than a reusable password secret.
Google's current passkey guidance describes passkeys as phishing-resistant because they are bound to the correct site. That is a useful advantage over typing the same password into a convincing imitation page.
Layer sign in with workspace controls
DripTell's public security page lists passkeys, TOTP codes, workspace-required two-factor authentication, trusted devices and active-session management. Use them as layers rather than substitutes.
- 1Name the personGive every teammate a separate login.
- 2Strengthen sign-inRegister a passkey and require 2FA.
- 3Limit the workGrant only needed actions and channels.
- 4Review and revokeInspect devices, sessions and departures.
| Control | What it changes | Owner check | Important limit |
|---|---|---|---|
| Named login | Connects access to one member | No shared credentials remain | Identity alone does not limit actions |
| Passkey | Removes routine password typing | Member registered a compatible method | Public evidence does not show mandatory passkeys |
| Required 2FA | Adds a workspace sign-in requirement | Recovery path is tested | It is separate from passkey policy |
| Roles and scope | Limits actions, channels and contacts | Access matches the job | Broad roles still create exposure |
| Device and session review | Finds access that should end | Unknown and stale sessions are revoked | Review must be repeated |
For a larger team, the enterprise controls make the permission discussion concrete. Record who owns workspace settings, who can export or automate data, and who only answers assigned conversations.
Roll out access without locking out the team
Next, enable the workspace two-factor requirement and test recovery with the owner. Offer passkey registration on compatible devices and explain that the biometric or PIN check happens locally. Do not collect fingerprints, face images, recovery codes or password-manager secrets from staff.
Review trusted devices and active sessions after enrollment. A familiar device name is not enough by itself; confirm the person, approximate timing and whether the session is still needed. Apply roles and per-member channel or contact access before the next busy shift.
The privacy page is the right companion for data handling. Authentication proves a teammate can enter; least privilege reduces the customer information available after entry.
Revoke access when work changes
Offboarding should target one person, not force a team-wide password scramble. Disable the member, revoke active sessions, remove trusted devices that no longer belong, and reassign their open conversations. Then inspect automation ownership so a departed administrator does not remain the only person who understands a critical rule.
Use DripTell automation with named operational owners. Keep API keys and webhook credentials in their controlled records; a passkey for the user interface does not rotate integration credentials.
Decide what DripTell evidence proves
The verified evidence supports live native workspace controls for passkeys, TOTP, a workspace two-factor requirement, trusted devices, sessions and granular permissions. Passkey enrollment remains device-dependent. Public evidence reviewed on 21 October 2026 does not prove mandatory passkeys or single sign-on, so buyers should not assume either.
Bring one owner, one agent and one leaver scenario to a DripTell walkthrough. Ask to see sign-in, permission scope and revocation separately. That reveals more than a generic promise of secure access.
Frequently Asked Questions
Can teammates use passkeys in DripTell
Yes. DripTell's current security page lists passkeys as a supported sign-in method. Each teammate should use a personal account and register a compatible personal method rather than share a credential.
Can an owner require passkeys
The public evidence confirms that a workspace can require two-factor authentication. It does not confirm a policy that forces passkeys specifically, so verify that requirement in your own workspace before making it a buying condition.
Does a passkey replace roles and permissions
No. A passkey strengthens authentication. Roles, action permissions and per-member channel or contact access decide what an authenticated person can do.
What should happen when a device is lost
Revoke the relevant active sessions and trusted-device status, verify recovery through an approved route, then register the replacement device. Review the member's permissions at the same time.
Want help applying this guide?Ask the DripTell team
From reading to action
Want help applying this to your business?
Share your details. We will read the article you are on and start with a useful answer for your team.
DripTell Editorial
Practical guidance reviewed by the DripTell product and customer workflow team.
See how DripTell checks product claims, uses primary sources and handles corrections.
Editorial and source policy
