Revealing a credential
Revealing is where you read a submitted credential. It’s decrypted in your browser, after a passkey confirms it’s you — the server never sees the plaintext.
Reveal a credential
Section titled “Reveal a credential”- Open the request. Its status is Submitted.
- Click Reveal. If it reads Unlock your vault to reveal, this browser needs your key first: unlock in the window that opens, then carry on.
- Confirm with your passkey (user verification). This is a fresh, single-use step-up every time.
- Your browser fetches the envelope, unseals it with your identity key, and decrypts the fields.
- Fields appear masked — hold to peek, or copy per field. A countdown clears them automatically (60 seconds unless your policy sets otherwise); closing the page clears them from memory immediately.
Every reveal is written to the audit log with the actor, device and time. If your policy turns it on, a note is also posted to the linked ticket saying the credential was revealed by a recipient.
What you need to reveal
Section titled “What you need to reveal”Two things, on the device you reveal from:
- Your identity key unlocked on this browser (a passkey PRF, or your recovery code).
- A passkey or security key to confirm the reveal itself.
If something’s missing, the reveal window says what and offers the fix in place — unlock, try again, or request the credential again — and a bar across every page warns when this browser can’t open your vault. A device with no usable passkey can’t reveal, even after unlocking. See Passkeys & unlocking, and I can’t reveal if you hit a snag.
Who can reveal
Section titled “Who can reveal”Only a recipient of the request can reveal it — being an Admin or Owner doesn’t grant it. If you need someone else to be able to reveal, add them as a recipient when you create the request, or use a team. The one exception is the organisation recovery key: if your org has one, an Owner can recover a credential with it — which needs the recovery code, their passkey and a reason, and every Owner and Admin is told.
When you’re done
Section titled “When you’re done”Complete and destroy the request so the record is destroyed — or just close the linked ticket and let it purge automatically.