> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/1key-biometric.md).

# 1Key Biometric

***

### Admin Setup

**Configure the Journey for Standard FIDO Login**

{% stepper %}
{% step %}
In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
{% endstep %}

{% step %}
Create a new journey or edit an existing one.
{% endstep %}

{% step %}
Under **Authentication Method**, select **FIDO**.
{% endstep %}

{% step %}
Assign the journey to the target user group or machine policy.
{% endstep %}

{% step %}
Save and publish the journey.
{% endstep %}
{% endstepper %}

### **Configure the Journey for Shared Account Login (CyberArk)**

{% stepper %}
{% step %}
In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**.
{% endstep %}

{% step %}
Create a new journey or edit an existing one.
{% endstep %}

{% step %}
Under **Authentication Method**, select **FIDO for Shared Account Login**.
{% endstep %}

{% step %}
Configure the CyberArk integration settings as required by your deployment.
{% endstep %}

{% step %}
Assign the journey to the target shared account user group.
{% endstep %}

{% step %}
Save and publish the journey.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
Before any user can authenticate with a FIDO2 key or 1Key, the key must be enrolled in the 1Kosmos platform. See [1Key Enrollment Documentation ](/authentication/1key-biometric/overview.md)for enrollment steps. Non-enrolled keys will not be recognised during authentication.
{% endhint %}

### User Guide

**Login with a Single-User FIDO2 Key**

{% stepper %}
{% step %}
Plug the FIDO2 security key into a USB port on the workstation.
{% endstep %}

{% step %}
At the Windows login screen, click the **1Kosmos** tile.
{% endstep %}

{% step %}
If using the **Other User** tile, enter your username first.
{% endstep %}

{% step %}
Click **Security Key**.
{% endstep %}

{% step %}
Place your enrolled finger on the key's fingerprint sensor.

* For biometric keys (such as 1Key), a PIN prompt is **not** presented, fingerprint is the sole authenticator on the key.
* For non-biometric FIDO2 keys, a PIN entry prompt appears. Enter the key PIN, then touch the key when it blinks.
  {% endstep %}

{% step %}
The Windows session unlocks and you are logged in.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
If fingerprint recognition fails after multiple attempts, clean the sensor surface with a dry cloth and retry. See [Troubleshooting](#troubleshooting) below for further guidance.
{% endhint %}

### **Login with a Multi-User Key / 1Key Desktop**

The 1Key Desktop is a desk-mounted biometric key that supports up to 3 enrolled user profiles per device.

{% stepper %}
{% step %}
Approach the workstation, the 1Key Desktop sensor is mounted on or near the desk.
{% endstep %}

{% step %}
Long-press the sensor to cycle through and select your enrolled user profile.
{% endstep %}

{% step %}
When your profile indicator is active, place your finger on the sensor.
{% endstep %}

{% step %}
Authentication is processed and the Windows session unlocks.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
If multiple users share the same workstation, ensure each user has enrolled their profile on the specific 1Key Desktop unit assigned to that workstation. Profile enrollment is device-specific.
{% endhint %}

### **Shared Account Login with 1Key (CyberArk Integration)**

{% stepper %}
{% step %}
Plug the 1Key into a USB port or approach the 1Key Desktop unit.
{% endstep %}

{% step %}
At the Windows login screen, click the **1Kosmos** tile.
{% endstep %}

{% step %}
Authenticate your primary identity using the 1Key (fingerprint, as described above).
{% endstep %}

{% step %}
A list of shared accounts you are authorised to access is displayed.
{% endstep %}

{% step %}
Select the target shared account from the list.
{% endstep %}

{% step %}
The Windows session launches under the selected shared account.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
The list of authorised shared accounts is sourced from CyberArk based on your primary identity's permissions. If expected accounts do not appear, verify your CyberArk entitlements with your privileged access administrator.
{% endhint %}

### Troubleshooting

| Issue                                             | Likely Cause                                                                                                  | Resolution                                                                                                                                                        |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Key not recognised by Windows                     | USB port issue; driver not loaded; key not enrolled                                                           | Try a different USB port; verify the Credential Provider service is running; confirm the key is enrolled in the 1Kosmos platform                                  |
| Fingerprint not recognised                        | Sensor surface dirty; enrolled finger not placed correctly; skin condition affecting read                     | Clean the sensor with a dry, lint-free cloth; ensure the full enrolled finger pad covers the sensor; re-enroll the fingerprint if the issue persists              |
| Wrong user profile selected on 1Key Desktop       | Incorrect profile activated via long-press                                                                    | Long-press the sensor again to cycle back to the correct user profile before placing the finger                                                                   |
| Shared account not appearing after authentication | CyberArk entitlement not granted; CyberArk integration misconfigured; journey not set to Shared Account Login | Verify CyberArk account permissions for the authenticated user; confirm the journey uses the FIDO for Shared Account Login method; contact your PAM administrator |
| PIN prompted for biometric key                    | Key firmware or enrollment issue                                                                              | Biometric 1Key keys should not prompt for PIN; re-enroll the fingerprint via the 1Key management tool; contact 1Kosmos support if the issue persists              |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/1key-biometric.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.