Use YubiKey for secure access to internal and external applications. Fortified ID Access handles authentication and connects it to your existing sign-in flows, while Enrollment gives users and administrators controlled ways to register keys.
YubiKey is particularly useful for administrators, privileged users and other roles where a physical, hardware-bound authentication method is desirable.
Book a meeting · Explore Integrity Access
Passkey or one-time code
Fortified ID can use YubiKey in two ways:
As a FIDO2 passkey
This provides passwordless, phishing-resistant authentication based on public key cryptography. The private key stays on the security key.
As an OATH hardware token
YubiKey can also generate one-time codes for MFA. This is useful where OTP is needed, but it does not provide the same phishing resistance as FIDO2.
Common uses
- Passwordless sign-in with a hardware-bound passkey
- MFA and step-up for sensitive resources
- Protection for administrator accounts and privileged access
- Sign-in through Access to SAML and OIDC applications
- Self-service or delegated registration through Enrollment
- Strong verification before password reset
- Controlled registration of a replacement key during onboarding or recovery
- Hardware-based passkeys alongside IDombud and organisation-owned digital identities
Plan for a lost key
A YubiKey cannot be copied like an ordinary file. Consider registering at least two keys per user or combining YubiKey with another approved recovery method.
If a key is lost, Fortified ID can support a controlled flow that verifies the user’s identity and registers a new authentication method. Your organisation can choose self-service or delegated handling according to the audience and risk level.
Strengthen access with YubiKey
We can help you choose the right combination of FIDO2, passkeys, OATH and policy-based authentication.