Skip to content

Use the portable YubiKey (keychain)

Saxon has two YubiKeys. This guide is for Key 2 — the portable key: a YubiKey 5 NFC on a keychain, meant to go with you when you leave the desk.

Use it when the desk key is not plugged in — on a phone, laptop away from home, or as backup if the desk key fails.

What it looks like

  • Small keychain device, slimmer than the desk USB-C key
  • Gold circle for tapping
  • NFC — can touch the back of a phone instead of plugging in

The desk key stays at the PC: Desk YubiKey.

When you need this key

Same important sites as the desk key — both keys were registered so losing one does not lock you out:

  • Vaultwarden / Bitwarden login
  • Cloudflare admin
  • Other services Saxon secured with hardware keys

Travel rule

If you travel, bring the portable key. Do not rely only on the desk key staying at home unless both keys are registered everywhere you need.

Before you start

  1. Have the keychain YubiKey physically with you.
  2. Know the YubiKey PIN — same PIN as the desk key (stored in Vaultwarden / handover notes).
  3. Phone or laptop ready with the app or browser asking for a security key.

Step-by-step — iPhone

1. Start login on the phone

  1. Open Safari or the app (e.g. Bitwarden).
  2. Enter email and password from Vaultwarden.
  3. When prompted for a security key, the phone shows instructions to hold the key near the top.

2. Use NFC

  1. Enter the YubiKey PIN if the phone asks.
  2. Hold the flat side of the keychain YubiKey against the top back of the iPhone (near the camera).
  3. When the key blinks, touch the gold circle.
  4. Hold steady until the phone confirms — usually one to three seconds.

3. Confirm

  1. You should be logged in.
  2. Remove the key from the phone — NFC stops automatically.

Step-by-step — Android phone

  1. Enable NFC in phone settings if it is off.
  2. Log in until the security key step appears.
  3. Enter YubiKey PIN if prompted.
  4. Hold the key to the back of the phone where NFC works (often upper centre — move slowly if unsure).
  5. Touch the gold circle when it blinks.

Step-by-step — laptop without the desk key plugged in

If the laptop has USB-C:

  1. Plug the portable key in with a USB-C adapter or use NFC if the laptop supports it (less common).
  2. Follow the same PIN → touch gold circle flow as Desk YubiKey.

If only USB-A ports:

  1. Use a USB-C to USB-A adapter if Saxon left one in the drawer — otherwise use your phone with the Bitwarden app and NFC.

Keeping the portable key safe

Treat it like a house key

Anyone who steals this key and learns your PIN could try to break into protected accounts. Keep it on your person or in a safe place — not loose in a bag pocket.

Do Don't
Keep on a keyring you carry Leave it in the car glove box long term
Register both keys on critical sites Register only one key and lose it
Report loss immediately and revoke the key online Wait days before telling Ryan

If this key is lost

  1. Do not panic — the desk key may still work at home.
  2. Log into Cloudflare and Bitwarden from home using the desk key.
  3. Remove the lost key from each account's security settings.
  4. Order a replacement YubiKey and register it alongside the remaining key.
  5. See Login troubleshooting if you cannot log in at all.

Troubleshooting

Problem What to try
Phone does not detect key Remove thick phone case. Move key slowly on the back. Try Bitwarden app instead of browser.
NFC off on Android Settings → Connected devices → NFC → On.
Wrong PIN Retrieve from Vaultwarden on a device that is still logged in, or from offline handover.
Only desk key was registered Some sites need both keys added — Ryan can add the portable key in account settings when logged in with the desk key.
Key physically damaged Use desk key at home; plan replacement.