FIDO2 — Yubico Authenticator User Guide documentation (2024)

Warning

The YubiKey provides a total of eight (8) attempts to enter the correct current PIN during a PIN change attempt, registration attempt, or authentication attempt. After three (3) incorrect attempts in a row, that key must be removed and reinserted into your device. After 8 incorrect attempts, the FIDO2 application becomes blocked and must be reset. Entering the PIN correctly resets the PIN attempt counter back to 8.

Creating a FIDO2 PIN

To create a FIDO2 PIN, do the following:

1. Plug your YubiKey Bio into your device, click the menu icon in the upper left corner of the app, and select Fingerprints.

2. Click Set PIN under Manage.

   In a narrow app window, click the three dots in the upper right corner of the app to find the Manage menu.

3. In the Set PIN window, enter your new PIN. For most keys, it must be at least 4 characters long and may contain letters, numbers, and special characters.

4. Enter the new PIN again to confirm and click Save.

Changing the FIDO2 PIN

To change the FIDO2 PIN, do the following:

1. Plug your YubiKey Bio into your device, click the menu icon in the upper left corner of the app, and select Fingerprints.

2. Click Change PIN under Manage.

   In a narrow app window, click the three dots in the upper right corner of the app to find the Manage menu.

3. In the Change PIN window, enter your current PIN.

   If you have forgotten your current PIN, the only way to change it is to reset the FIDO2 application of your YubiKey to factory default settings (which will remove the PIN). Note that this will delete ALL fingerprints and passkeys stored on the YubiKey, and you will no longer be able to access those accounts with that key (we recommend registering at least one backup YubiKey with each account/service to maintain access). Once reset, you can always re-register your key with those same accounts and services.

4. Enter your new PIN; for most keys, it must be at least 4 characters long and may contain letters, numbers, and special characters.

5. Enter the new PIN again to confirm and click Save.

Enroll a fingerprint

To enroll a fingerprint, do the following:

1. Plug your YubiKey Bio into your device, click the menu icon in the upper left corner of the app, and select Fingerprints.

2. Enter your FIDO2 PIN and click Unlock. If you don’t have a PIN yet, create one.

3. Click Add fingerprint under Setup.

   In a narrow app window, click the three dots in the upper right corner of the app to find the Setup menu.

4. In the Add fingerprint window, press a finger against the biometric sensor of your key. When the window prompts you to “keep touching your key”, remove your finger and place it back on the sensor. Repeat this until the progress bar reaches 100% completion.

   Make sure to touch both the sensor and bezel and adjust your finger pressure so that as much of your print is in contact with the sensor as possible; this will improve the quality of the reading. For additional tips on enrolling fingerprints, see the YubiKey Bio documentation.

5. Once the fingerprint is captured successfully, enter a Name for the fingerprint and click Save. You will now see your new fingerprint listed under Fingerprints.

   If you click cancel, the fingerprint will still be saved, but it will be given a name of the form Unnamed (ID: XXXX). If you made a mistake, you can always rename or delete the fingerprint.

Rename or delete a fingerprint

To rename or delete an existing fingerprint, do the following:

1. Plug your YubiKey Bio into your device, click the menu icon in the upper left corner of the app, and select Fingerprints.

2. Enter your FIDO2 PIN and click Unlock.

3. Click on the fingerprint you would like to manage.

4. To rename the fingerprint, click Rename fingerprint under Details. Enter a new Name and click Save.

5. To delete a fingerprint, click Delete fingerprint under Details. To confirm the operation, click Delete.