FIDO Keys

FIDO passkeys enable passwordless login using biometrics or hardware security keys instead of passwords.

---

Authenticator Types

• Security Keys - Authenticators used to verify a user's identity. These can be external hardware security keys (USB, NFC, or Bluetooth) that authenticate using a touch, PIN, or biometric verification, or platform-based security keys stored on devices such as smartphones or computers (for example, passkeys on iPhone authenticated with Face ID or Touch ID). Security keys are also referred to as roaming or platform authenticators, depending on where they are stored.

• Platform Authenticators - built into the user's device; authenticate using face recognition or fingerprint (e.g. Apple Touch ID/Face ID, Windows Hello, PIN)

FIDO2/WebAuthn is supported on Chrome, Firefox, Edge, and Safari.

WebAuthn is not supported in incognito/private browsing windows.

Admin Configuration

FIDO authentication is configured under Authentication > FIDO in AdminX. Toggle Enable FIDO Login Using Security Keys & Platform Authenticators on or off as needed.

When enabled, expand the toggle to restrict authentication to a specific type - Security Keys only, Platform Authenticators only, or both.

Managing Allowed Security Keys

Every tenant comes pre-populated with the most commonly used security key models. Administrators can enable or disable individual models, add new ones, or update existing metadata.

• Enable/Disable a model — toggle the switch next to any listed key and confirm with Save

• Add a new model — click Add New Key, provide a name, upload the manufacturer's FIDO metadata file (JSON format), and set the enabled state

• Edit an existing model — click the pencil icon to update the name or replace the metadata file

Disabling a key model immediately prevents users with that key from authenticating.

FIDO metadata files must be in JSON format. Contact your key manufacturer directly if you need the metadata file.

Configuring Custom Authenticators Names

Use the Security Key Authenticator Names setting to list the custom authenticator names your organization issues, so passkeys reporting those names are counted as security keys during registration.

To configure the setting:

1. In AdminX, go to Authentication > FIDO.

2. In the Security Key Authenticator Names section (between the enrollment options and the Allowed Security Keys list), click Add new.

3. Enter an authenticator name. Repeat to add more names.

4. To remove a name, delete its entry.

5. Click Save Changes.

The setting is optional and applies per community — communities with no names configured keep their existing behavior.

---

User Device Enrollment

Users enroll their FIDO devices from My Profile in AdminX. Both platform authenticators and security keys are registered from the Setup drop-down menu on that page.

Registering a Platform Authenticator

Go to My Profile > Setup > Platform Authenticator, click Use Platform Authenticator, grant browser permission when prompted, and give the device a unique name. The authenticator appears under the Devices tab once registered.

Registering a Security Key (e.g. YubiKey)

Go to My Profile > Setup > Security Key, click Use Security Key, insert the key into a USB port and tap it to verify presence, then assign a unique name. The key appears under the Devices tab once registered.

Logging in with FIDO

On the sign-in page, enter your username, select Security Key from the authentication method menu, then confirm with biometrics or a PIN (platform authenticator) or by tapping the device (security key).

The Security Key option only appears if a FIDO authenticator is already registered to the account.

Removing an Authenticator

Go to My Profile, locate the device under the Devices tab, click the trash icon, and confirm removal.

Cross-Browser Usage

A FIDO authenticator registered on one browser can be used on a different browser on the same device.

Cross-browser authenticator use is not currently supported on Mac due to OS limitations.