> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/1key-biometric/faqs.md).
# FAQs
What is 1Key?
1Kosmos 1Key is a biometric authenticator that allows users to authenticate to Windows machines using a fingerprint. It is intended for environments where mobile devices are not allowed, such as contact centers.
What are the three components of 1Key?
1Key consists of:
* **Auth Server** — Manages devices, key banks, API keys, and provides the AuthX UI dashboard.
* **Auth Agent** — Installed on end-user workstations and communicates with the Auth Server.
* **Auth Manager** — Installed on end-user workstations. End users open this application (named **ThinC Manager** in Windows) to enroll their fingerprint and security key.
What do I need before installing 1Key?
You need:
* Reachability to the BlockID tenant and the Auth Server public IP from the end-user machine
* Administrator permission for installation
* The 1Key Device Template Excel sheet from your vendor
* 1Key devices with unique Keybanks (loaded at manufacturing time)
* Keybank details from the vendor
* A firewall rule allowing communication on port 443 to the Auth Server
* Reachability to MongoDB from the Auth Server
* A MongoDB connection string and a service account with permission to create a database
For details, see Prerequisites.
What ports does 1Key use?
* **Port 443** and **port 12500** on the Auth Server (TCP).
* **Ports 443 and 30500** (TCP) for optional device firmware upgrades, reaching either Keybank server `20.212.64.15` or `authx.ensurity.com`.
What is a Key Bank?
A Key Bank is a set of cryptographic keys loaded onto 1Key devices at manufacturing time. Each 1Key device has a unique Keybank. Key Bank details are obtained from your vendor and entered into the Auth Server during setup.
How do I authorize 1Key devices?
Upload the 1Key Device Template Excel sheet (provided by your vendor) in the AuthX UI dashboard under **Devices → Import Excel**.
For details, see Upload device template to authorize devices.
How does an end user enroll their fingerprint?
After completing the standard Windows logon, the user opens ThinC Manager from the Start menu, signs in with their Active Directory account, and enrolls their fingerprint through the Device Management module. They then add their security key through the Account Management module.
For step-by-step instructions, see Enrollment.
How does an end user authenticate after enrollment?
At the Windows logon screen, the user selects the **login with key** icon at the bottom-left corner, enters their user ID, and provides their enrolled fingerprint when the 1Key device lights up.
For step-by-step instructions, see Authentication.
Can a user authenticate on a different machine from the one they enrolled on?
Yes. Once enrolled, a user can authenticate on any Windows machine with a connected 1Key device — the machine and fingerprint reader do not need to be the same ones used during enrollment.
Can a user enroll multiple fingers?
Yes. During enrollment, repeat the **Add Another** step in the Device Management module to add additional fingers.
How do I generate the API key for the Auth Agent?
In the AuthX UI dashboard, navigate to **Settings → API Keys → New API Key**, enter a name, provide a unique random alphanumeric string in the Key field, set an expiry date, and click **Save**. The API key must be unique for each customer.
For details, see Add API key for Auth Agent.
How do I verify the Auth Agent is running?
Open `services.msc` and navigate to **Auth Agent Service**.
What if I cannot reach the Auth Server in a browser after installation?
The local Windows firewall may be blocking it. Create an inbound firewall rule for TCP ports **443** and **12500**.
For details, see Configure firewall rule.
What if enrollment or authentication fails?
Contact your administrator. The source documentation does not describe specific troubleshooting steps for end users beyond contacting their administrator.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.1kosmos.com/authentication/1key-biometric/faqs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.