«Create the administrator passkey first to continue.» (passkey_enrolment_required)

Symptom

An administrator signs in with a password and the console only shows their own account, with «First sign-in.» and «Create the administrator passkey to continue. The password only authorizes this first authenticator.» Any other action gives «Create the administrator passkey first to continue.» The API answers 403 passkey_enrolment_required.

Cause

An administrator account without a passkey cannot administer. The password only authorises registering the first authenticator.

Fix

1. Open «Protect» › «Trusted devices» › «Create passkey».
2. Name the device, type the current password and choose «Create ProofFlow passkey».
3. Confirm with biometrics, the PIN or the security key.
4. Sign out and sign in again with «Sign in with a passkey (this device)».

In a new organization, activation already creates the passkey; if that step failed, use «Continue activation» on the sign-in page.

When to escalate

If the browser does not support passkeys («This browser does not support creating passkeys.»), use another current browser or device. If you have no compatible device at all, ask your provider for help.