diff --git a/src/lib/server/services/appointment-service.ts b/src/lib/server/services/appointment-service.ts
index 0616d9a..099577f 100644
--- a/src/lib/server/services/appointment-service.ts
+++ b/src/lib/server/services/appointment-service.ts
@@ -850,6 +850,7 @@ export class AppointmentService {
             tunnelId: clientData.tunnelId,
             userId: share.userId,
             encryptedTunnelKey: share.encryptedTunnelKey,
+            // TODO: passkeyId
           })),
         );
       }
diff --git a/src/routes/(pages)/dashboard/account/passkeys/+page.svelte b/src/routes/(pages)/dashboard/account/passkeys/+page.svelte
index f376f54..81c28ef 100644
--- a/src/routes/(pages)/dashboard/account/passkeys/+page.svelte
+++ b/src/routes/(pages)/dashboard/account/passkeys/+page.svelte
@@ -47,7 +47,11 @@
           {#snippet triggerLabel()}
             <PlusIcon /> {m["account.passkeys.add.title"]()}
           {/snippet}
-          SetupPasskeyForm?
+          <ul>
+            <li>Do more or less what's done in setup passkey form</li>
+            <li>send it to POST /api/auth/passkeys</li>
+            <li>do more or less what grant access form does</li>
+          </ul>
         </ResponsiveDialog>
 
         {#if items.length > 0}
@@ -123,6 +127,24 @@
           >
             {#if curItem}
               Delete
+              <ul>
+                <li>Cannot delete last passkey (check be for this as well)</li>
+                <li>
+                  Delete
+                  <ul>
+                    <li>Remove from db</li>
+                    <li>Go through tunnels and remove this passkey from it</li>
+                    <ul>
+                      <li>
+                        On creation of a new client tunnel, also sve user passkeyId in
+                        client_tunnel_staff_key_share `// TODO: passkeyId`
+                      </li>
+                      <li>migration of already existing passkeys</li>
+                      <li>Delete from client_tunnel_staff_key_share where userId and passkeyId</li>
+                    </ul>
+                  </ul>
+                </li>
+              </ul>
             {/if}
           </ResponsiveDialog>
         {:else}
diff --git a/src/routes/(pages)/dashboard/staff/(components)/grant-access-form/grant-access-form.svelte b/src/routes/(pages)/dashboard/staff/(components)/grant-access-form/grant-access-form.svelte
index c2e26a5..acab60d 100644
--- a/src/routes/(pages)/dashboard/staff/(components)/grant-access-form/grant-access-form.svelte
+++ b/src/routes/(pages)/dashboard/staff/(components)/grant-access-form/grant-access-form.svelte
@@ -64,7 +64,7 @@
 
           return {
             tunnelId: tunnel.id,
-            encryptedTunnelKey: encryptedForNewStaff[0].encryptedTunnelKey,
+            encryptedTunnelKeys: encryptedForNewStaff.map((it) => it.encryptedTunnelKey),
           };
         }),
       );
diff --git a/src/routes/(pages)/dashboard/staff/(components)/utils.ts b/src/routes/(pages)/dashboard/staff/(components)/utils.ts
index 0967f91..abc8522 100644
--- a/src/routes/(pages)/dashboard/staff/(components)/utils.ts
+++ b/src/routes/(pages)/dashboard/staff/(components)/utils.ts
@@ -34,7 +34,7 @@ export const fetchClientTunnels = async (tenantId: string) => {
 export const addStaffKeyShares = async (
   tenantId: string,
   staffUserId: string,
-  keyShares: { tunnelId: string; encryptedTunnelKey: string }[],
+  keyShares: { tunnelId: string; encryptedTunnelKeys: string[] }[],
 ) => {
   const resp = await fetch(`/api/tenants/${tenantId}/appointments/tunnels/add-staff-key-shares`, {
     method: "POST",
diff --git a/src/routes/api/tenants/[id]/appointments/tunnels/add-staff-key-shares/+server.ts b/src/routes/api/tenants/[id]/appointments/tunnels/add-staff-key-shares/+server.ts
index 787530c..073f52c 100644
--- a/src/routes/api/tenants/[id]/appointments/tunnels/add-staff-key-shares/+server.ts
+++ b/src/routes/api/tenants/[id]/appointments/tunnels/add-staff-key-shares/+server.ts
@@ -56,8 +56,11 @@ registerOpenAPIRoute("/tenants/{id}/appointments/tunnels/add-staff-key-shares",
                     description: "Tunnel ID to add key share for",
                   },
                   encryptedTunnelKey: {
-                    type: "string",
-                    description: "Tunnel key encrypted with staff member's public key",
+                    type: "array",
+                    items: {
+                      type: "string",
+                      description: "Tunnel key encrypted with staff member's public key",
+                    },
                   },
                 },
                 required: ["tunnelId", "encryptedTunnelKey"],
@@ -143,7 +146,9 @@ const requestSchema = z.object({
   keyShares: z.array(
     z.object({
       tunnelId: z.string().uuid("Invalid tunnel ID format"),
-      encryptedTunnelKey: z.string().min(1, "Encrypted tunnel key cannot be empty"),
+      encryptedTunnelKeys: z
+        .array(z.string().min(1, "Encrypted tunnel key cannot be empty"))
+        .min(1, "encryptedTunnelKeys list must hat at least one item"),
     }),
   ),
 });
@@ -267,7 +272,7 @@ export const POST: RequestHandler = async ({ params, locals, request }) => {
           newKeyShares.map((keyShare) => ({
             tunnelId: keyShare.tunnelId,
             userId: staffUserId,
-            encryptedTunnelKey: keyShare.encryptedTunnelKey,
+            encryptedTunnelKeys: keyShare.encryptedTunnelKeys,
           })),
         )
         .returning({