Hardware security keys
Enroll WebAuthn credentials and enforce hardware-backed sign-in for privileged members.
Hardware security keys provide WebAuthn authentication for organization access. Enforcement can require an approved hardware-backed credential for privileged roles or sensitive actions.
Enroll a key
Open Account → Security keys from the installation's configured HTTPS origin. Register the key through the browser's credential flow and give it a recognizable name. Infra stores credential metadata and the public authentication material; it does not receive the authenticator's private key.
Enroll a second approved key before enforcing the policy for a recovery owner. A key registered for one relying-party origin cannot be assumed to work after an unrelated hostname change. Review origin migrations with SSO and recovery procedures.
Apply enforcement
You have the Organization Owner role. Open Authentication → Security keys and select the required principal classes and authenticator policy. A generic synchronized passkey is not automatically treated as an approved hardware key when policy requires hardware-backed evidence.
Enforcement can require enrollment before further privileged access. It does not stop running droplets. API service accounts use their scoped credentials and policy controls rather than interacting with a physical key for every request.
Reauthentication
Sensitive actions can require recent authentication in addition to an existing session. A temporary role grant does not bypass that requirement. Sign-in through an identity provider must satisfy the configured authentication assurance policy or complete the required local step.
Lost keys
Use a second enrolled key or the organization's approved recovery-owner procedure. An administrator resetting enrollment must record the verified member identity, reason, and affected credentials. Recovery does not mean disabling enforcement for every organization member.
Revoking a key prevents new authentication through that credential. Review active sessions separately when responding to a lost device. Removing a key does not revoke SSH public keys or service-account tokens.
See temporary access, single sign-on, and certificate origins for related boundaries.