Security
Security is under your avatar in the header. It holds the three things that prove you are you: your password, an authenticator app as a second step, and passkeys that sign in on their own.
Every change to a second factor asks you to confirm it is you first, with your current password or a code from the app. That is asked in the moment, each time; there is no window during which it is skipped.
Changing your password
Section titled “Changing your password”Enter the current password, the new one, and the new one again. The new password needs at least six characters. Changing it signs you out everywhere, including the browser you are in, so you sign in again with the new one straight away. That is deliberate: a password change is usually the moment you want every other session gone.
Authenticator app
Section titled “Authenticator app”Set up authenticator app turns on a second step at sign-in. Confirm your password, scan the QR code with your authenticator app (or enter the key by hand), and type the six-digit code it shows to verify. From then on, signing in with a password asks for a code after it.
When you turn it on you are shown ten recovery codes, once. Download them or copy them somewhere safe: each one works a single time, in place of the app, and they are the way back in if you lose the phone. New recovery codes replaces the whole set, and the old ones stop working.
Turn off removes the second step; sign-in asks for your password only again.
Passkeys
Section titled “Passkeys”A passkey signs you in with nothing else: no password, no code. It is Touch ID or Face ID on this machine, your phone, or a security key, and it cannot be phished or reused on another site.
Add a passkey asks you to confirm it is you, then to give it a name you will recognise later (“MacBook Touch ID”, “YubiKey”, “iPhone”), then hands over to your browser to create it. A browser that cannot create passkeys says so; a current Safari, Chrome, Edge or Firefox can. Passkeys that sync (iCloud Keychain, Google Password Manager) follow you to your other devices.
Each passkey is listed with its name. Remove deletes it; your other passkeys and your password are unaffected. Keep at least one other way in before removing the last one.
Passkeys are tied to the app’s address. If Care Connect ever moves domain, they would need to be registered again; nothing you do day to day affects that.