Signing In, Passwords and Passkeys

Steps: Sign In

Every sign-in page is one small card with the Crossroad Sellers mark at the top, on every auction house's site alike: your account is yours, not any house's. The sign-in address is login.crossroadsellers.com; a Sign In link anywhere on the platform takes you there and brings you back.

1. Type your email, then Continue. If your device holds a passkey for this site, it offers it right in the email box (fingerprint, face, PIN or a security key); use it and you are in.
2. Enter your password and press Sign In. Show lets you see what you typed. If this browser signed in with a passkey last time, this step offers the passkey first, with Use your password instead underneath.
3. Stuck? Try Another Way opens Choose How to Sign In, every other door, the same list for everyone: a passkey from another device (your phone can sign you in on a computer), your password, an emailed sign-in code, or Google.

Never set a password? Choose Email me a sign-in code. A six-digit code goes to your email (it is in the subject line, so a phone shows it without opening anything), you type it into the six squares, and it signs you in; it lasts ten minutes and works once. The code page continues by itself once the sixth digit is in, and you can paste the code. If an address has no account, the page still says a code was sent, and that mailbox gets an email saying there is no account and how to create one (at most once a day).

If your account both bids and works at an auction house (or the platform), you are then asked What are you here to do? with a tile for each role you hold, named as the role: Bidder; Owner, Administrator or Staff; Platform staff or Platform support. Pick one; tick Don't ask again and every sign-in lands there. Switch any time from your picture in the corner, where the role line under your name opens the same list, and change the standing answer on your account page under What you are here for. A plain bidder is never asked, and neither is a staff member or owner who has never registered to bid: the question appears the first time you register to bid somewhere.

Switching up always asks again. Moving from the bidder view into the auction house console, or from anywhere into the platform, asks you to confirm it is you right then — your passkey, security key or authenticator code — every time, even if you confirmed a minute ago for something else; the platform roles take a passkey or security key only. Switching down (platform → house, house → bidder) is instant. The console and the platform only open in their own role: if you are wearing the bidder hat and open a console page, you are sent to choose. A console or platform session that sits idle for 30 minutes drops back to the bidder view by itself, and going back up asks again — so a computer left open cannot be walked up to and used as the house or the platform.

The second page, the other-ways list and the code page look the same for every email, and a wrong password or a wrong code gets the same words whoever you are, so nobody can type an address into the sign-in page and learn whether it has an account.

Steps: Sign In with Google

If Continue with Google is on the sign-in page, it is a third way in, for bidders.

1. Press Continue with Google and choose your Google account.
2. New here? You are asked to agree to the terms and data policy once, then you are signed in with a login and no auction house yet — like any registration. Back on the lot you came from, press Register to bid at (house) to ask that house to approve you, as with any bidder.
3. Already have an account with a password? You are stopped at the door and told so: You already have an account. Type that account's password once and Google is connected to it; you get an email saying so, and you are signed in. From then on Continue with Google signs you straight in. A wrong password counts like any other wrong password, and Forgot your password? is right there if you need it.
4. Been here before with Google? You are signed in. If you added an authenticator or a security key, you finish with that first, the same as always — Google does not skip it.

You have one account per email, always. Google added to a password account is the same account — your password still works. If you first signed up with Google and later want a password too, use Forgot your password? on the sign-in page: the reset link proves the address is yours and lets you set one. Either way it is one login, never two.

Google is for bidders only. An account that works at an auction house (staff, administrator or owner) or on the platform is refused at the Google door with a message saying so, even if it used Google while it was only a bidder. Staff sign in with a passkey or a password and then their second factor, as always.

The sign-in page remembers you. After you sign in once on a browser, the page offers that email as one click next time, up to three of them, for 30 days, even after you sign out. It only saves the address, never a password. On a shared computer press Forget beside an address to take it off the list, or Use another email to type one.

Steps: Stop Being Asked for the Second Factor on Your Own Computer

1. Sign in with your password. On the Confirm It's You page tick Don't ask again on this browser for 30 days before you press Confirm; the box sits under the code squares.
2. For 30 days that browser signs you in with the password alone. Other browsers and other people's accounts on the same computer are still asked.
3. To take it back: your picture → Security → Trusted Browsers → Forget. Adding or removing a passkey or authenticator, new recovery codes, or a reset by the owner or platform staff forgets every trusted browser at once.

Only tick it on a computer that is yours. A passkey never needs it: it is one step already.

The Confirm It's You page starts on your strongest method (a security key or passkey, then the authenticator app) and lists the others under Other ways, including a recovery code. The authenticator code goes into six squares and continues by itself once all six digits are in.

Steps: Add a Passkey so You Never Need the Password

The easy way: right after you sign in with your password or an emailed code, a page called Skip the Password Next Time offers to add a passkey on that device. Press Add a Passkey and use your fingerprint, face or PIN when the device asks; no password is asked again, because you typed it a moment ago. Your password keeps working as a backup. Not Now asks again in 30 days on that browser; Don't Ask Again stops the offer for good on your account (you can still add one below). A device that cannot make a passkey never shows the offer. If it is your first passkey or authenticator you are shown your Recovery Codes once, right there: save them.

The other way, any time:

1. Press your picture → Security.
2. Add a passkey: Touch ID, Face ID, Windows Hello, your phone, or a security key. You will be asked for your password once, and to set or use the device's PIN or fingerprint.
3. From then on the sign-in page offers the passkey as soon as you type your email. A passkey added before this change still works as a second factor; add it again for one-step sign-in.

Steps: Add a Second Factor

1. Press your picture → Security.
2. Add a passkey (above) or Add an authenticator app and scan the code it shows.
3. Save the Recovery Codes it gives you; each works once if you lose the device.

The Ways to Sign In Page

Your picture → Security → Ways to Sign In lists every way, one section each, with what it is and when: Google (if you signed up with it; Disconnect works only once a password, passkey or authenticator backs it up, so you cannot lock yourself out), Password (when it last changed; Change or Set a Password emails you a link that lasts 30 minutes; Go Passwordless), Passkeys (each with when it was last used, Rename and Remove; Add a Passkey), Authenticator App (on since when; Remove), Security Keys (a USB key, the strongest way; Add a Security Key) and Recovery Codes (how many of eight are left; Make New Codes). The first time you press anything that adds or removes a way, a small window asks for your password once, so a borrowed session cannot; Rename opens a small window for the new name.

Lost Your Second Check? Someone Who Knows You

Press I can't use any of these on the second-check screen. An owner's trusted contact (or, for staff, an administrator of the house) can let you back in after speaking to you: two PINs over the phone, or a scanned code and four digits in person. All of it is in Locked Out? Your Trusted Contact Lets You Back In.

Nothing Works: Ask for a Reset

On the sign-in screens, Can't use any of these? (under Choose How to Sign In, and under the second check as I Can't Use Any of These) opens Ask for a Reset: say what happened (a lost or replaced phone, a lost security key, a deleted authenticator app, or something else), give a phone number we can reach you on now, and press Send Reset Request. A person on the platform team reads it and calls or emails you back, usually the same day; nothing about the account changes until they have checked it is really you. The page says Request Sent whether or not the address has an account, on purpose.

Where You Are Signed In

Security → Your Devices lists every browser and phone signed in to your account, this one marked This Device, with Sign Out on each of the others; the trusted browsers that skip the second check, with Forget; and Sign Out Everywhere Else, which signs out every other browser, phone and trusted browser and keeps this one. Signing out of this browser is under your picture.

Recent Activity

Security → Recent Activity is one list, newest first, of the last 90 days: every sign-in and every security event (a role switched up, contact details changed, an alert emailed, a freeze or a bring-back), with what, where (browser and network address) and when, and This Wasn't Me on every row.

Passwords

Passwords must be at least twelve characters. A short phrase you will remember beats a clever word with symbols. When you choose one, the site also checks it against Have I Been Pwned, a free public list of passwords that have leaked in data breaches, and refuses one that is on it. Your password never leaves the site for that check: only a fragment of a scrambled version does, which cannot be turned back into it. If the check cannot be reached, your password is accepted anyway. The same list is checked when you sign in: a password that was fine when you chose it can leak later. If it has, you are let in, but nothing opens until you choose a new one on a page called Choose a New Password, confirmed with a code emailed to you; every other browser and phone is then signed out. Change it under your picture → Security. Forgotten it? Use the link on the sign-in page; a reset link is emailed to you, works once, lasts 30 minutes, and signs you out everywhere when used. Staff, owners and platform staff always keep two ways to sign in: removing a passkey, security key or authenticator is refused if fewer than two would remain (the password counts as one); add another first. Using a recovery code to sign in always emails you, with how many are left.

Going Passwordless

With two other ways in — two passkeys or security keys, or one plus an authenticator app — you can drop your password altogether: Security → Ways to sign in → Go Passwordless (your password once, to confirm). From then on a passkey, security key, authenticator or an emailed code signs you in, and there is no password for anyone to phish or guess. Want one back? Ask for a reset link on the sign-in page; it sets a new one. Every other browser and phone is signed out when you drop it, as with any change to your ways in.

A Second Factor

Optional for bidders, and worth it if you buy often. Under your picture → Security you can add:

• a passkey: Touch ID, Face ID, Windows Hello or a security key. This one also signs you in on its own, with no password.
• an Authenticator App that shows six-digit codes, asked for after your password.

Adding one gives you Recovery Codes. Print them or put them somewhere safe; each works once if you lose the device.

Steps: Make New Recovery Codes

Running low, or the sheet went missing? Make a new set any time.

1. Your picture → Security → Recovery Codes.
2. Type your current password and press Make New Codes.
3. If your last check was more than ten minutes ago you are sent to Confirm it is you first: your passkey or authenticator code. Then come back and press the button again.
4. The new eight are shown once. Save them before you leave the page.

The old codes stop working the moment the new ones exist, even the ones you never used, and every other signed-in session and trusted browser is signed out. You are emailed that new codes were made. If you did not do it, change your password and remove any method you do not recognise.

Adding or removing a factor asks for your password again, emails you, and signs out every other session, so a borrowed login cannot change your locks.

"Confirm It's You"

A few things ask for a fresh check even when you are signed in, and even on a trusted browser. If your last check was more than ten minutes ago you are sent to Confirm it is you first: your passkey or your authenticator code if you have one, otherwise your password. Then you are returned to where you were. A laptop left open in a coffee shop should not be enough to change who controls your account or move money.

The whole list, for everyone:

• opening Security at all, and each of its sections
• editing your profile, changing your phone, closing your account, making new recovery codes
• for auction house staff: publishing an auction, connecting or refreshing the payout account, refunding or voiding an invoice, paying a consignor, resetting a staff member's sign-in
• for platform staff: a house's fee, granting or removing platform staff

Changing Your Email or Phone

Both are doors to your account (codes go to them), so both are guarded. Email: Personal info → Change it next to your email. You confirm it is you first, then we send a six-digit code to the new address; nothing changes until you type that code, and when you do, your account moves, every other browser and phone is signed out, and your old address is told with a This wasn't me button. If the new address already belongs to another account, the page says the same thing but no code is sent (that mailbox is told it has an account), so the form cannot be used to find out which addresses are taken. Phone: Personal info → Phone; a code is texted to the new number, and once it is confirmed your email is told with the same button. Neither can be changed while a recovery lock is on.

"This Wasn't Me"

When you sign in from a browser your account has not used before, we email you: when, how (password, code or passkey), and which device. If that was you, do nothing. If it wasn't, press This wasn't me in the email, or sign in and choose This Wasn't Me on the row under Security → Recent Activity. Either way you see what was reported and are asked to confirm — opening the email link on its own locks nothing, so a mis-click or a mail scanner cannot lock you out.

Lock My Account does four things at once: signs everyone out, including any phone with the app; freezes the account so nobody can sign in or place a bid on it by any means; puts the account under a seven-day recovery lock; and opens a case with the platform's team, who check it is really you and bring you back in (reply to the case email to reach them). You are emailed the case number. Any auction house where you were an approved bidder is told, so bids placed while someone else was in can be looked at — the house decides, and the bid log is never edited.

Two things to do straight away: change the password on your email account too (whoever got in may have read your email), and change any other password you reused.

The link in the email works once and dies after a week; it can only ever lock, never unlock.

Getting back in afterwards: a full platform admin checks it is really you (a reply from your email, or a call to the phone on file), then brings the account back from the case. You are emailed a link to choose a new password; your old one no longer works. The seven-day lock on changes stays until it lifts. Every step — the freeze, the bring-back, who did it — shows under Security → Recent activity.

Where Your Account Lives

Since 29 September 2026 your account has three addresses, and each one is its own building in the browser, so a bug on one can never reach the others:

• account.crossroadsellers.com — your account hub: home, personal info, payments and ID, notifications, privacy and data. A sidebar lists them, with ← Back to Crossroad Sellers at the top.
• login.crossroadsellers.com — signing in, registering, and Security (passwords, passkeys, authenticator, recovery codes, trusted browsers, where you are signed in). It opens as the same small card as sign-in, wider on a desktop, with ← Back to your account at the top.

Security's front page shows status, never details: five tiles — Ways to Sign In (how many, never which), Getting Back In (recovery codes ready, running low, or none), Email and Phone (confirmed or not; the page behind it shows where your codes go, with Change on each), Your Devices (how many), Recent Activity (how many sign-ins in 30 days). Anything wrong turns red and moves to the top under a heading that says how many things need your attention; a bidder with only a password sees a nudge to add a passkey, an owner or staff member without a second way sees Console Locked with the button to add one; a recovery lock shows as a banner and marks the paused tiles. The details — key names, dates, devices — are inside each tile, and both the front page and the sections ask for a fresh check first (your passkey, authenticator code or password), so someone at your unlocked computer cannot walk in and add a passkey of their own.

• crossroadsellers.com and each auction house's own site — the auctions, and Your Bids (bids, watchlist, invoices, saved searches, houses you follow).

Every old address still works: it sends you to the new one, signed in, with nothing to type. Your picture in the corner opens the same places it always did.

Where Your Account Lives

Since 29 September 2026 your account has three addresses, and each one is its own building in the browser, so a bug on one can never reach the others:

• account.crossroadsellers.com — your account hub: home, personal info, payments and ID, notifications, privacy and data. A sidebar lists them, with ← Back to Crossroad Sellers at the top.
• login.crossroadsellers.com — signing in, registering, and Security (passwords, passkeys, authenticator, recovery codes, trusted browsers, where you are signed in). It opens as the same small card as sign-in, wider on a desktop, with ← Back to your account at the top.
• crossroadsellers.com and each auction house's own site — the auctions, and Your Bids (bids, watchlist, invoices, saved searches, houses you follow).

Every old address still works: it sends you to the new one, signed in, with nothing to type. Your picture in the corner opens the same places it always did.

Sessions

Signing in keeps you signed in for two weeks of use on that browser; anyone with a staff console is signed out after twelve hours without using it. Signing out ends it. Too many wrong passwords lock the account for fifteen minutes. Where you are signed in, every open session with when it started and where from, is under Security → Your Devices, with Sign Out on each.

From the App

Forgot your password? on the app's sign-in screen sends the same reset email as the website; the link in it opens the website to choose a new password, then you sign in on the phone. If you have no date of birth on file, the app asks for it on the Account tab (Confirm now) before you can bid — the same rule as the website, and once confirmed it does not change.

Your Phones

The Crossroad Sellers app on your iPhone signs in once — your email and password (and your passkey or authenticator code if you have one set up), or your passkey on its own — and stays signed in on that phone. It is the same account as the website: one login, every auction house.

Your phones, under Security → Your Devices, lists every phone signed in to the app, with when it was last used. Sign out signs one out at once, from any computer, so a phone that is lost or sold cannot bid or see your alerts. Bids you already placed stay. A phone not used for ninety days is signed out on its own, and any change to your passkeys, authenticator or recovery codes, a password reset, or closing your account signs every phone out. The app's own Your phones page does the same thing from the phone; it appears on the app's Account tab only when more than one phone is signed in, since with one phone there is nothing to sign out but the one in your hand.