Skip to content

YubiKey & 2FA — FAQ

Two YubiKey 5 devices — desk (USB-C) and portable (keychain NFC). See Yubikey doc.

YUB-001 — What are the two YubiKeys?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Desk YubiKey 5C NFC at PC. Portable YubiKey 5 NFC on keychain. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-002 — Which key for daily PC use?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Desk key plugged into Windows PC at 192.168.2.200. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-003 — Which key for phone?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Portable key — tap NFC to back of phone. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-004 — Both keys registered everywhere?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Should be — losing one key shouldn't lock you out. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-005 — Lost a YubiKey?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Use the other key immediately.
  2. Revoke lost key in Cloudflare, Bitwarden, every service.
  3. Register replacement. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-006 — YubiKey PIN — where?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. In Vaultwarden — not SaxDocs. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-007 — Wrong PIN too many times?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Key may block — recovery details in vault/handover. Stop guessing. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-008 — Touch the gold circle?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Yes — after PIN, touch metal circle when prompted. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-009 — Security key not found?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Replug desk key directly — not through hub if possible.
  2. Try other USB port. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-010 — Windows Hello asks for key?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Insert desk key, enter PIN, touch circle. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-011 — Cloudflare login needs key?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Yes — dash.cloudflare.com — both keys registered. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-012 — Bitwarden 2FA with key?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. At vault login — register both keys in account settings. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-013 — Phone NFC not working?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Enable NFC in phone settings.
  2. Hold key flat against upper back of phone. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-014 — iOS WebAuthn popup?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Enter PIN, tap portable key to phone back. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-015 — Android WebAuthn?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Same — NFC tap portable key when prompted. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-016 — Need key for Authentik?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Usually no — password only. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-017 — Need key for MyState/Vanguard?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Depends on how Saxon set 2FA — check vault notes per bank. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-018 — Travel — which key?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Take portable keychain key — not desk-only setup. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-019 — Desk key unplugged by accident?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Plug back in — retry login or swap to portable key. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-020 — Browser says cancel or timeout?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Retry — touch circle within timeout window. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-021 — Multiple keys plugged in?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Unplug spare — browser may pick wrong one. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-022 — Register new key after replacement?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Log into each service (Cloudflare, Bitwarden…) → security → add key. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-023 — Backup codes vs YubiKey?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Backup codes one-time — store in vault. Keys are daily use. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-024 — Key physically damaged?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Use other key, revoke broken one, order YubiKey 5 NFC replacement. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-025 — Child needs to use key?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Only with supervision — PIN in vault, Ryan handles tech per will. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-026 — Key not working after Windows update?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Update YubiKey firmware/drivers via Yubico site if Ryan advises. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-027 — Firefox vs Chrome key behavior?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Both support WebAuthn — try other browser if one fails. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-028 — Find keys after Saxon died?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Desk: PC USB port. Portable: keychain, wallet, bedside — First 24 hours. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-029 — Only one key found?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Use it — register replacement ASAP on all services. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-030 — No keys found?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Vault may be unreachable without keys if 2FA required — urgent Ryan/handover recovery. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-031 — Key required but I'm not Saxon?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Ryan inherits tech — keys should work if registered for account you use. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-032 — Can I disable YubiKey?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Not recommended — weakens security. Ryan only for emergency. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-033 — Desk key guide?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Use desk YubiKey. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-034 — Portable key guide?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. Use portable YubiKey. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable
YUB-035 — What is 2FA?

Stack context: YubiKey 5 desk + portable · WebAuthn Integrated runbooks: Auth stack · Yubikey

Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

  1. What is 2FA — second proof besides password. Verify: Repeat the original symptom check — it should be gone or clearly improved. Deep dive: Desk key · Portable