Managing YubiKeys

Yubico Authenticator provides all management capabilities for YubiKeys and Security Keys by Yubico. With the the YubiKey Bio in particular, you can use other methods of enrolling fingerprints and setting PINs, but only the Yubico Authenticator enables you to label your fingerprint templates and delete individual templates.

You can, of course, delete fingerprint templates by resetting the key, but that resets the key back to factory defaults, removing everything from it: all fingerprints, all credentials. To reset using a GUI, see Resetting FIDO2 Function in the YubiKey Manager CLI and GUI Guide. To reset using the CLI, see FIDO Commands in the same guide.


Do not click the Clear button visible on the main page of the Authenticator unless you mean to delete all your saved passwords.


Clear Button

Configuring WebAuthn/FIDO2 Capabilities

The WebAuthn/FIDO2 screen enables you to control the way the YubiKey handles or behaves with certain aspects of this protocol and websites that implement WebAuthn.


The FIDO2 PIN is the prerequisite for configuration: without a PIN, there is no management at all. For example, if a YubiKey Bio cannot read a fingerprint, entering the PIN is an easy workaround. It should be noted that PINs in general, and the FIDO2 PIN in particular are a topic unto themselves, and understanding some PIN basics will save you a lot of troubleshooting. For more details, see Yubico’s knowledge base article Understanding YubiKey PINs.

Deleting credentials can be important to ensure personal safety.

To set and manage the PIN, enroll fingerprints and manage stored credentials,

Step 1:

Launch the Yubico Authenticator, and select the YubiKey menu option. The Information window appears.


If the YubiKey menu option is already selected, click the three dots or the X on the upper right.

The Information window appears.

Step 2:

Scroll down past the word Configuration to reveal the WebAuthn (FIDO2/U2F) option:

Step 3:

Click the little caret to the right. The WebAuthn (FIDO2/U2F) screen appears.


PIN Protection

Managing the FIDO2 PIN

Because the PIN is the principal credential, it must be set at the start of configuration. The PIN protection menu option on the WebAuthn (FIDO2/U2F) screen enables you to set or change the PIN.

If you have previously set a PIN that you cannot remember, you have eight tries before the key locks up. Once the key is locked, your only option is to reset it. Use the YubiKey Manager to reset the PIN.


For all the details on YubiKey PINs in general (not just FIDO2 PINs), see our comprehensive knowledge-base article, Understanding YubiKey PINs.

Setting the PIN

Select YubiKey, then the > to the right of Configuration, and finally, on the WebAuthn (FIDO2/U2F) screen, Create a PIN. You are prompted to enter and confirm a PIN with four alphanumeric characters at minimum.


Changing the PIN

Select YubiKey, then the > to the right of Configuration, and finally, on the WebAuthn (FIDO2/U2F) screen, Change PIN. You are prompted to enter the current PIN. If you do not know it, you must reset the YubiKey before you can change it.


Data

Viewing, Labeling, and Deleting Individual Credentials

Credentials include the sites with which the key is registered. Deleting the evidence that you have used sites or services can be essential in some situations.

To view any credentials stored on the key, to label fingerprint templates, and to delete individual credentials (including templates),

Select YubiKey, then the > to the right of Configuration, and finally, on the WebAuthn (FIDO2/U2F) screen, the > to the right of Sign-in data. On the Credentials screen,

If it is a new YubiKey, there will be no credentials listed.


If there are credentials of any sort stored on the key, you are prompted to enter the PIN before you can view them:


If it is a YubiKey Bio with fingerprints enrolled, the templates will be listed.


To label a fingerprint template, click the Edit icon.


Managing Fingerprint Templates

This section is relevant only to the YubiKey Bio. Before fingerprints can be used to authenticate to any site or service, they must be enrolled on the key, which records them as templates (for details, see the Technical Manual for the YubiKey Bio).

Enrolling Fingerprints

To enroll a fingerprint on the YubiKey Bio, select YubiKey, then the > to the right of Configuration, and finally, on the WebAuthn (FIDO2/U2F) screen, the > to the right of Fingerprints. The Fingerprints screen appears. Click Add.


When the Add Fingerprint screen appears, apply your fingerprint to the sensor, touching the bezel ring as well. Lift and repeat, changing the angle of pressure slightly each time so that the key can read the full print. The progress bar below the fingerprint icon shows how much of your print has been read.


When the key has captured the full print, click Continue. You are prompted to label the template. It will not be saved unless you label it.


Add more fingerprint templates up to a total of five (5).

Labelling Templates

If you use the Yubico Authenticator to enroll fingerprints, you are obliged to label them. However, if you use other means, such as Yubico’s YubiKey Bio start page, the templates have automatically assigned IDs that are seldom intuitive:


To label such a template, on the Fingerprints screen, click the edit icon next to the unnamed template.

Reset Defaults

Completing this procedure involves several steps.

To return your YubiKey to its factory default condition, with no FIDO2/U2F sign-in data (credentials), no PIN and no fingerprints (if applicable), click Reset.

You are prompted to unplug your YubiKey.


The status bar above the Cancel button shows the progress of the operation. The reset is not complete until the bar is entirely red, and the Cancel button turns into a Continue button.

When prompted, reinsert your YubiKey.


When prompted, touch the YubiKey (on a YubiKey Bio, touch the sensor) to finish the reset.


To authenticate with sites and services to which you have previously registered using this key, you will need to register the key again, because it will not be recognizable as the same key.

To file a support ticket with Yubico, click Support.