Purchasing Models

Note

Effective January 1, 2026, the program and pricing for YubiKeys and subscription programs were updated. Subscription programs purchased before this date will continue to be fully supported until the contract terms are fulfilled. Upon contract renewal, the new subscription program will apply. For more information, please contact Yubico.

YubiKey as a Service is a set of services that enable organizations to efficiently procure, rapidly distribute, and remotely manage YubiKey strong authentication solutions at scale.

All YubiKeys are part of one or more product tiers. Products can be added to your inventory as subscription purchase of product tiers, or non-subscription perpetual outright purchase of products. You can purchase directly from Yubico, or through a reseller.

The exact numbers and models of YubiKeys the end users of your organization will want or need can be difficult to predict. With a YubiKey as a Service Subscription you can purchase YubiKey licenses through an end user-based subscription model where you only have to declare the number of end users, and decide on the security key functionality requirements for your organization. You can then select preferred YubiKeys over time, with replacement and upgrade options as needs evolve.

The different purchasing options are described in more detail in the following.

Tier Options

A tier is a collection of YubiKey models representing a level within a hierarchy of product sets.

All YubiKeys are part of one or more product tiers associated with subscription program:

  • Base - includes the Security Key Series, FIDO-only support.
  • Advanced - includes YubiKey 5 Series, multi-protocol support.
  • Compliance - includes all certified YubiKeys, multi-protocol support, and YubiKey Bio.

For more information, see Subscriptions.

Key Models Per Tier

The following provides an overview of available YubiKey models in each subscription tier.

Note

Subscription tiers are additive. For example, if you select the Advanced tier, you can also request YubiKeys from the Base tier. If you select the Compliance Tier, you can also request YubiKeys from the Base or Advanced tier.

_images/tier-key-models1.png

Base Tier - provides access to:

  • Security Key NFC
  • Security Key C NFC
  • Enterprise Edition Security Key NFC
  • Enterprise Edition Security Key C NFC

Note

Enterprise Edition Security Keys, only available through a subscription, include laser marked serial numbers for asset tracking, enterprise attestation, and FIDO Pre-reg.

Advanced Tier - provides access to:

  • YubiKey 5 NFC
  • YubiKey 5C NFC
  • YubiKey 5C
  • YubiKey 5 Nano
  • YubiKey 5C Nano
  • YubiKey 5Ci

Compliance Tier - provides access to:

  • YubiKey 5 NFC FIPS
  • YubiKey 5C NFC FIPS
  • YubiKey 5C FIPS
  • YubiKey 5 Nano FIPS
  • YubiKey 5C Nano FIPS
  • YubiKey 5Ci FIPS
  • YubiKey Bio - FIDO Edition
  • YubiKey C Bio - FIDO Edition
  • YubiKey Bio - Multiprotocol Edition
  • YubiKey C Bio - Multiprotocol Edition

Note

The YubiKey Bio Multiprotocol editions, only available through a subscription, include support for PIV in addition to FIDO.

For technical details about different YubiKey models, see the YubiKey Technical Manual.

Purchasing Options

While a Subscription offers the most comprehensive and best value choice pricing over 3 years with additional entitlements included, you also have the option to outright purchase YubiKeys using the non-subscription Perpetual option.

When deciding on a purchasing model for your organization, consider the following:

  • What are the security requirements for your organization, for example regarding compliance and the type of systems and services you need to secure?
  • What authentication capabilities, authentication protocols, and certification options will you be needing?
  • Will your users require one or two YubiKeys?
  • Will you be deploying YubiKeys to internal employees only, or will you extend this to your partners and/or customers?
  • How quickly are you hoping to complete the roll-out - is there an upcoming event that requires additional services?
  • Will your organization ship keys in bulk to a single location, or single keys to multiple locations? With the Yubico Delivery service you can ship up to 500 keys to the US, Canada and EU, and a single key at a time to most other countries around the world.
  • Will your organization need customization of some kind? With the Yubico Customization service you can for example get FIDO pre-registered YubiKeys, or custom configurations, laser marking, or packaging.
  • Would your organization benefit from end user self-service ordering? The Yubico End User Order service lets your end users order YubiKeys to their preferred location.

The following sections provide guidance when deciding upon a purchasing model.

Subscriptions

Subscriptions are structured into these tiers with all services included at no additional cost:

  • Base Tier
  • Advanced Tier
  • Compliance Tier

For available YubiKeys in each tier, see Key Models Per Tier.

YubiEnterprise Services are priced by user and tier. Available services include YubiEnterprise Delivery, FIDO Pre-reg, customization of YubiKeys, End User Ordering (currently in Early Access), as well as discounts such as 25% replacement allowance, and a 25% discount on a second YubiKey per user.

A subscription automatically renews for original subscription term length (3, 4, or 5 years) unless one party provides the other party with written notice of non-renewal at least 30 days prior to the end of the current term. For detailed information, see Yubico Terms & Conditions.

Licenses

A license is an entitlement which allows an end user to use a YubiKey for business purposes for the organization that purchased the subscription. With licenses you can select the desired YubiKey model(s) for your different end users as the need arises for your organization.

A subscription contains a certain number of YubiKey licenses that are charged at a fixed price per license and end user.

In general, a license can be of the following type:

  • Primary - Main license for the total number of active users at the start of the subscription term period. Every user must have a primary license. A subscription with 500 users will have 500 primary licenses where each of the 500 users are entitled to use a YubiKey of their choice.
  • Backup - granted to a primary user needing two or more extra YubiKeys as backup. One or more backup licenses can be paired with a primary license. It is a separate license because all additional backup licenses will be 25% off the price of the primary license when two or more keys are supplied to the same user.
  • Primary Replacement - granted to a new user. For example, a new hire replacing an employee who left the organization. The employee that left is allowed to keep their YubiKey and continue using it for personal use. The new employee takes over the primary license and is granted their own YubiKey via the Replacement license. Up to 25% Primary Replacement licenses are included for the subscription term period
  • Backup Replacement - Replacement of backup YubiKeys for new non-primary users. If a primary user has been granted two keys (Primary and Backup licenses), and that user leaves and a new (non-primary) user is hired to replace the employee that left, the new user will receive both a Primary license (Primary replacement) and a Backup license (Backup replacement). Up to 25% Backup Replacement licenses are included.

Perpetual Purchasing

While a Subscription offers the most comprehensive and best value choice pricing over 3 years with additional entitlements included, you also have the option to outright purchase YubiKeys using the non-subscription Perpetual option.

Purchasing a set number of specified models of key on a perpetual basis assumes that you know exactly how many end users you will have, as well as how many and what kinds of YubiKeys those end users will need. It also assumes that you have accurately estimated your employee turnover rate, and the number of end users who will need new keys.

Subscription vs. Perpetual

The following shows a comparison between features and included services for the Subscription and Perpetual purchasing options.

YubiKeys for all users
  • Subscription: Licenses for one or more YubiKeys per user and a variety of services.
  • Perpetual: YubiKeys with no included services.
Pricing
  • Subscription: Priced by user and tier: Base Tier $15 per user/year; Advanced Tier $35 per user/year, Compliance Tier $55 per user/year, for all form factors available in a tier.
  • Perpetual: Different pricing per YubiKey depending on the form factor.
Payment cadence
  • Subscription: Yearly, the organization pays the number of user licenses x the price of the respective tier.
  • Perpetual: Full upfront payment for all YubiKeys.
Replacement licenses
  • Subscription: All tiers come with 25% replacements for employee churn or lost keys.
  • Perpetual: No replacements included, the organization has to buy additional YubiKeys.
Second YubiKey
  • Subscription: A second YubiKey can be added as backup for 25% less.
  • Perpetual: Full price must be paid for a second key if needed.
Form factor flexibility
  • Subscription: Organizations can choose desired form factors when ordering YubiKeys.
  • Perpetual: Less form factor flexibility, users may not get their desired YubiKey.
Fleet Replacement
  • Subscription: For Compliance Tier with FIPS keys, 100% of the primary and backup licenses can be replaced with a new version of FIPS YubiKeys when available, at any point in the subscription (no renewal required).
  • Perpetual: All new keys must be purchased in order to remain compliant.
FIDO Pre-reg
  • Subscription: Pre-registered YubiKeys included for available identity providers.
  • Perpetual: Pre-registered YubiKeys not included.
Customer End User Order (available 2026)
  • Subscription: Administration user interface for accessing various Yubico services, view purchases and inventory, order YubiKeys, track deliveries. Includes the End User Order service.
  • Perpetual: The End User Order service is not available.
Customization
  • Subscription: Custom configuration and laser marking, and custom packaging of YubiKeys included.
  • Perpetual: Customizations available at additional costs.
Delivery
  • Subscription: World-wide delivery available for all subscription tiers, cost depends on shipping destination, customs, and taxes.
  • Perpetual: Will receive shipments in bulk, and must pack and distribute the YubiKeys to end users.
Accessories
  • Subscription: Option to purchase accessories like YubiKey covers and lanyards, and pair these with YubiKeys when shipping through the Delivery service.
  • Perpetual: Accessories can be purchased, but must be manually added to packages.
Professional services
  • Subscription: Up to 80 hours of Professional Services included in first year, then 20 hours included in all subsequent years for no additional cost.
  • Perpetual: Professional Services can be purchased “a la carte”.
Customer Success Manager
  • Subscription: A dedicated Customer Success Manager is assigned to all subscription customers, for support throughout the entire subscription period.
  • Perpetual: Not available.
Priority support
  • Subscription: Included at no extra cost.
  • Perpetual: Provided for $15,000 per year.

Accessories

Yubico products also include accessories, for example lanyards, keyports and key covers that can be shipped to your end users together with YubiKeys.

As a Subscription customer you have the option to purchase accessories and pair these with YubiKeys when ordering YubiKeys through the Delivery service in the YubiEnterprise Console. For example, an end user may be granted a YubiKey 5 NFC YubiKey and a YubiKey cover, which can be added to the same shipment request.

As a Perpetual customer you can purchase accessories, but these must be manually added to packages when shipping YubiKeys to your end users.

Purchasing through Resellers

The entity through which a purchase order is submitted is referred to as a channel partner. This can be Yubico itself (direct sale), or a reseller or distributor doing business with Yubico.

The YubiEnterprise Console Dashboard shows your total inventory of any given product, combining quantities purchased from all sources, both directly from Yubico and indirectly through resellers.

Your inventory is sorted according to the source from which it was purchased. When creating a shipment request, you can choose from inventory purchased directly from Yubico, or through a distributor/reseller associated with your organization. Whether purchased directly or through a distributor/reseller, you have access to the same services, for example the ability to automatically fulfill licenses with YubiKeys through the YubiEnterprise Console or the API.

To find out what is in which inventory, check your purchase orders. The reseller name and ID can be viewed in the Purchase order detail page.

Purchasing Workflow

The subscription contract is a signed order form that covers Yubico terms. The contract is followed by a purchase order (PO), required for invoicing and payment. The start date of the subscription determines when the annual replenishment of the Replacement inventory takes place. The PO must include an email address for the customer, and distributor or reseller where applicable. As soon as a PO is accepted, it is entered into the YubiEnterprise Delivery system.

With a Subscription, you have access to the YubiEnterprise Console user interface where you can view your purchase orders, and create shipment requests for delivery of YubiKeys to your end users. Your product purchases become available as inventories (“buckets”), from which you can conveniently create shipment requests to deliver the YubiKeys to your end users.

Using the YubiEnterprise API, you can also integrate the Delivery Service with your organization’s systems, to initiate shipment of YubiKeys from for example your identity provider.