How to Use a Security Key for Two-Step Authentication

What is a security key?

A security key is a hardware-based device that plugs into a computer to simplify two-step authentication. When prompted to authenticate, you simply tap the physical key. There’s no need to use your smartphone, and the same security key can be used on multiple devices.

Purchase a security key

If you want to use a security key, you’ll need to purchase one.

• You can order a Yubikey security key directly from  https://www.yubico.com/products/.
• Use your stanford.edu email address to claim an educational discount of 20% at https://www.yubico.com/education-offer/.
• Any Yubikey 4 Series, Yubikey 5 Series, or Security Key Series Yubikey can be self-enrolled as a Stanford two-step authentication compatible security key. If you need to authentication to non-web-based services, purchase a Series 5 Yubikey. The Security Key Series does not have passcode capablilties. 
• Once you receive your Yubikey, you can follow these instructions to self-enroll your security key via the Stanford accounts webpage.

Self-enroll a security key

Follow these instructions to self-enroll your security key for two-step authentication.

1. Open a browser and visit the Stanford Accounts page.
2. Click Manage, authenticate if requested, and click the Two-Step tab.
3. Authenticate to access the My Settings & Devices screen.
4. A page showing your two-step authentication devices displays.
   
5. Click + Add another device.
   
6. Select Security Key and click Continue.
   
7. Click Continue.
   
8. Click OK.
   
9. Insert your Yubikey into an open USB port.
   
10. Touch Yubikey sensor (some types will blink). After successful enrollment, you should return you to the My Settings & Devices screen with your newly added Security Key displayed.
    
11. Close your Stanford Accounts browser window.

Authenticate with a security key

1. When prompted for Two-Step Authentication, it will either offer you the method you last used to authenticate (e.g., Duo Push, etc.).
   
   If this is not a Security Key, click Other options to display other methods that may be available to you.
   
2. Click Security Key.
   
3. Insert your Security Key into an open USB port.
   
4.  Touch the Security Key sensor (some types will blink) to complete two-step authentication.

Delete or rename a security key

Navigate to your My Settings & Devices screen, and click the Device Options for your Security Key. Then click on the red Trashcan icon to delete, or Change Device Name to rename.