Secondary Keyholders
A secondary keyholder helps manage an existing shared lock using permissions agreed for that session. The primary keyholder keeps ownership. You can have up to three secondary keyholders per lock; pending invitations also reserve a place.
Your consent comes first
Secondary keyholding is optional. The wearer, primary keyholder, and invited person must each explicitly approve the same permissions before access becomes active. Sending an invitation alone grants no access. Other secondary keyholders do not approve someone else's invitation.
Trusting the primary keyholder does not automatically give another person access. Each person needs a separate invitation and approval. If you are uncomfortable with the proposed access, decline the invitation.
Before accepting, the wearer should know that they cannot remove an active secondary keyholder themselves. The primary keyholder can remove them, and the secondary keyholder can leave at any time. While an invitation is still pending, the wearer can decline or cancel it.
Invite someone
The primary keyholder or wearer can propose an invitation on an eligible active shared lock.
- Open the lock details and find Secondary keyholders. Choose Add secondary keyholder. If someone is already listed, choose Manage access, then Add another secondary keyholder.
- Search by username and select the intended account.
- Review Default permissions or choose Customize permissions. Check the photo, information-sharing, editing and action permissions, along with the agreed limits.
- Choose Review invitation, read the terms, and confirm your approval with Approve and send invitation.
Sending the invitation records the sender's approval. The other two participants must approve within seven days. If someone declines or the invitation expires, access does not activate. The seven-day deadline applies to accepting the invitation; approved access does not expire seven days later.
Review an invitation
Open the invitation notification and review its terms. Check who sent it, the wearer, the primary keyholder, and the invited account. Read Allowed actions, Editing access, the excluded actions, and Agreed limits before deciding.
To accept, select the approval checkbox and choose Accept these permissions. Use Decline invitation if you do not agree. Review later postpones your decision and does not accept the invitation.
Permissions cannot be silently expanded after approval. Changing the person, permissions, or agreed limits requires ending the existing invitation or access and sending a fresh invitation for everyone to approve.
Photos and private information
Verification photos require the separate “Review verification submissions” permission. It allows the secondary keyholder to view verification photos and approve or reject submissions for this session. Review this permission even when using the defaults; choosing defaults is not a substitute for checking what you are sharing.
To keep verification photos private, turn this permission off when creating the invitation. If you receive an invitation with it enabled and do not agree, decline and ask for a new invitation with it disabled.
Combination photos and the lock combination are always excluded, including when verification or editing permissions are enabled.
Other information has its own access rules:
| Information | What the secondary keyholder can see |
|---|---|
| Session status and timing | Available with active secondary access, even if timing is hidden from the wearer. |
| Private notes | Requires Read private notes. This includes notes from earlier in the same session, with no permission to edit or delete them. |
| Session activity | Requires Read session history. Includes earlier and future activity in this session; private conversations, other sessions and protected combination data are excluded. |
| Geofence location | Requires Location for geofencing and the wearer's location consent. Covers this lock's geofences and the current location needed for them, not unrelated location history or phone control. |
When the lock appears publicly, an active secondary keyholder's username, avatar, role and profile link can appear on the wearer's profile, the public voting list or the pillory gallery. This public attribution is included in the invitation's approval terms.
Controls and editing permissions
After approval, the secondary keyholder uses the normal lock details page and its existing controls. Open Secondary keyholders → Review permissions to check the agreed access. Available buttons depend on the permissions, lock type and current state. For example, card locks use card controls rather than the ordinary Add/Remove Time buttons.
Action permissions cover things such as adding or removing time, freezes, tasks, verification reviews, device commands and offering an allowed hygienic break. Device commands still require wearer consent and must respect the device's limits.
Manage virtual gags is an optional action permission and is off by default. With this permission and a trusted primary keyholder, the secondary keyholder can apply or remove the wearer’s virtual gag through the community-chat user menu or a member’s message/member menu in a manual or automatic keyholder group that both people can access. A group gag applies only to that group; it does not mute direct messages, community chat, or other groups. The primary keyholder can also remove it, and admins can always remove a gag, including for moderators. A gag applied by a secondary keyholder clears when their access ends, trust is removed, ownership changes, or the lock session ends. Existing secondary approvals do not gain this permission; enabling it requires a fresh invitation approved by all three participants.
Editing permissions are separate. They can expose the existing lock, safety, card/limit, device, Programmable Lock or extension configuration controls. Edit lock settings also enables Casino Games using the wearer's shared credits; purchases and cash-outs are logged as the acting keyholder's actions.
Review editing access carefully. Saved configuration changes can remain after the secondary role ends. For Programmable Lock, normal future program triggers keep the saved configuration's behavior; running a program directly as the secondary keyholder still requires the relevant action permissions and allowances. See secondary-keyholder editors for details.
Secondary access never allows someone to:
- Directly unlock the lock or send device open/release commands.
- Reveal the combination or view combination photos.
- Invite another keyholder or delegate control.
- Transfer ownership, replace the primary keyholder, or promote themselves.
- Reset the session or abandon the whole lock.
- Manage parental phone control through this role.
Shared limits
Read the invitation's Agreed limits alongside its permissions. Agreed timer deadlines remain binding, and stricter current lock rules still apply. Removing time can bring normal completion closer, but cannot bypass an agreed minimum timer deadline.
New and existing secondary keyholders use the primary keyholder's current limits for enabled permissions unless you agree a tighter custom cap. Existing access does not require a new invitation or another approval. With a trusted primary keyholder, there is no extra 24-hour session addition cap; agreed custom caps and lock deadlines still apply. If primary trust is removed, the current limited-keyholder rules apply.
Where the invitation uses the 24-hour session addition allowance, all secondary keyholders share it with a limited primary keyholder. A trusted primary does not spend this allowance. An older invitation's inherited allowance stops applying while the primary is trusted; explicit custom caps remain in place. It is a session total, not a daily reset or a fresh allowance for each secondary keyholder. Removing time or reinviting someone does not refund usage. Casino time conversions also respect the accepted timing bounds and shared addition allowance.
With trusted-primary limits, Freeze can run until stopped and has no separate daily start limit. The secondary can also unfreeze the lock using the primary control. A custom duration or daily cap limits this; an agreed maximum deadline still applies. For example, a 30-minute per-action cap makes each freeze timed, and a daily count of one allows only one start. Older invitations also inherit this behavior. Their old fixed once-per-day default is treated as inherited, while selectable custom count and duration caps remain binding.
Trusted-primary terms also use the normal task-penalty and hygiene-setting limits. Hygiene offers can use the existing custom duration and expiry controls, and still require wearer acceptance. Device commands use the device's normal limits and consent, with any agreed intensity, duration, interval or count caps applied on top. Supported continuous device modes are unavailable when a duration cap is set. Geofence effects retain their configured cooldown and count limits.
Any daily limits reset at UTC midnight; the permissions view shows the next reset in your timezone. Daily time allowances count the amount requested, and early unfreezing does not refund usage. Changing the agreed red-card time conversion stops secondary timing actions until fresh terms are approved.
Leave or remove access
- Secondary keyholder: choose Leave lock on the lock details page or in the permissions view, then confirm. This leaves your secondary role; it does not end the lock or change its primary keyholder.
- Primary keyholder: open Manage access, select the person, choose Remove secondary keyholder, and confirm.
- Wearer: you can review active access, but removal must be handled by the primary keyholder or by the secondary keyholder leaving.
Access also ends when the session completes or primary ownership ends. A timer reaching zero does not necessarily mean the session has completed if another requirement remains. Once access has ended, adding time or reopening requirements does not restore the old approval.
Leaving or removal stops future authorization. It cannot undo completed actions, erase information already viewed or copied, or retract a command already accepted by a device. Saved configuration changes are not automatically rolled back.
Frequently asked questions
Can I decline having a second keyholder?
Yes. You can choose Decline invitation. A second keyholder cannot get access without your explicit approval, even if your primary keyholder wants to invite them. Declining does not change your existing primary keyholder.
This applies while the invitation is pending. If you have already approved and access is active, the primary keyholder must remove the secondary keyholder, or the secondary keyholder can leave. The wearer cannot remove active secondary access themselves. See Leave or remove access.
Can a secondary keyholder see my verification photos?
Only if Review verification submissions is enabled in the invitation that all three participants approve. This is a separate permission, so check it even when using the defaults. If you do not want to share verification photos, decline an invitation with that permission enabled and ask for one with it disabled. Combination photos are always excluded. See Photos and private information.
Can the agreed permissions be changed later?
They cannot be edited in place. Cancel a pending invitation, or end active secondary access, then send a fresh invitation with the new permissions or limits. The wearer, primary keyholder and invited person must all approve again before the new access becomes active. Trust in the primary keyholder does not automatically expand the secondary keyholder's permissions.
Can a secondary keyholder leave without asking permission?
Yes. Choose Leave lock on the lock details page or in the permissions view, then confirm. The primary keyholder does not need to approve your departure. You leave only your secondary role; the lock continues with its existing primary keyholder.
Who can remove an active secondary keyholder?
The primary keyholder can open Manage access, select the person, and choose Remove secondary keyholder. The secondary keyholder can also leave themselves. The wearer cannot remove active secondary access, although they can decline or cancel an invitation while it is still pending.
Leaving or removal stops future access, but does not undo completed actions, erase photos or information already viewed or copied, or automatically roll back saved settings. See Leave or remove access.