> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/passwordless-for-web-apps/login-methods/fido-keys.md).

# FIDO Keys

***

### Authenticator Types

* **Security Keys** - Authenticators used to verify a user's identity. These can be **external hardware security keys** (USB, NFC, or Bluetooth) that authenticate using a touch, PIN, or biometric verification, or **platform-based security keys** stored on devices such as smartphones or computers (for example, passkeys on iPhone authenticated with Face ID or Touch ID). Security keys are also referred to as **roaming** or **platform authenticators**, depending on where they are stored.
* **Platform Authenticators** - built into the user's device; authenticate using face recognition or fingerprint (e.g. Apple Touch ID/Face ID, Windows Hello, PIN)

FIDO2/WebAuthn is supported on Chrome, Firefox, Edge, and Safari.

{% hint style="warning" %}
WebAuthn is not supported in incognito/private browsing windows.
{% endhint %}

### Admin Configuration

FIDO authentication is configured under **Authentication > FIDO** in AdminX. Toggle **Enable FIDO Login Using Security Keys & Platform Authenticators** on or off as needed.

When enabled, expand the toggle to restrict authentication to a specific type - Security Keys only, Platform Authenticators only, or both.

#### Managing Allowed Security Keys

Every tenant comes pre-populated with the most commonly used security key models. Administrators can enable or disable individual models, add new ones, or update existing metadata.

* **Enable/Disable a model** — toggle the switch next to any listed key and confirm with **Save**
* **Add a new model** — click **Add New Key**, provide a name, upload the manufacturer's FIDO metadata file (`JSON` format), and set the enabled state
* **Edit an existing model** — click the **pencil icon** to update the name or replace the metadata file

{% hint style="warning" %}
Disabling a key model immediately prevents users with that key from authenticating.
{% endhint %}

{% hint style="info" %}
FIDO metadata files must be in `JSON` format. Contact your key manufacturer directly if you need the metadata file. 
{% endhint %}

Click **Save Changes** at the bottom of the page after making any updates.

***

### User Device Enrollment

Users enroll their FIDO devices from **My Profile** in AdminX. Both platform authenticators and security keys are registered from the **Setup** drop-down menu on that page.

#### Registering a Platform Authenticator

Go to **My Profile > Setup > Platform Authenticator**, click **Use Platform Authenticator**, grant browser permission when prompted, and give the device a unique name. The authenticator appears under the **Devices** tab once registered.

#### Registering a Security Key (e.g. YubiKey)

Go to **My Profile > Setup > Security Key**, click **Use Security Key**, insert the key into a USB port and tap it to verify presence, then assign a unique name. The key appears under the **Devices** tab once registered.

### Logging in with FIDO

On the sign-in page, enter your username, select **Security Key** from the authentication method menu, then confirm with biometrics or a PIN (platform authenticator) or by tapping the device (security key).

{% hint style="info" %}
The Security Key option only appears if a FIDO authenticator is already registered to the account.
{% endhint %}

### Removing an Authenticator

Go to **My Profile**, locate the device under the **Devices** tab, click the **trash icon**, and confirm removal.

#### Cross-Browser Usage

A FIDO authenticator registered on one browser can be used on a different browser on the same device.

{% hint style="info" %}
Cross-browser authenticator use is not currently supported on Mac due to OS limitations.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/passwordless-for-web-apps/login-methods/fido-keys.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.