Overview
Security Keys (WebAuthn) provide the highest level of account security by using physical hardware devices or built-in authenticators (such as Touch ID or Face ID) for two-factor authentication.
This document explains how users interact with security keys within our platform.
🔑 What Are Security Keys?
Security keys are physical or built-in authentication devices that provide strong, phishing-resistant two-factor authentication.
Examples include:
Physical devices: YubiKey, Google Titan Key, FIDO2 USB/NFC keys
Platform authenticators: Chrome’s built-in security (Windows/Mac), Safari’s Touch ID integration (macOS/iOS), Microsoft Edge (Windows Hello integration), and Mozilla Firefox (supports WebAuthn on all major platforms with standard security prompts).
Adding (Registering) a Security Key
Existing User Journey
Existing users who already have an account and Two-Factor Authentication (2FA) enabled can register one or more security keys for added login protection.
Log in using your standard credentials and complete 2FA verification(currently authenticator app).
Navigate to User settings → Account security → Security keys.
Click Add new key.
A modal window opens prompting you to enter a key nickname.
Example nicknames: YubiKey Office, iPhone Touch ID, MacBook Touch ID.
Click Continue.
The browser displays a security prompt based on the selected authenticator type:
Physical key: Insert and touch the key.
Touch ID: Place your finger on the sensor.
Face ID: Look at the camera.
Once verified, the system confirms successful registration.
The newly added key appears in the Security keys list within the account settings.
New User Journey
New users can register their first security key during initial setup if their 2FA feature flag is enabled.
Sign up and complete the email verification process.
After verification, you are redirected to the Sign-in page.
If the 2FA feature flag is enabled for your account, you are prompted to set up Two-Factor Authentication on the Setup 2FA page.
Note: If the 2FA flag is disabled, the new user flow remains the same as the current one, i.e., register on the authenticator app.
Choose between the available 2FA options:
Add an Authenticator App
Add a Security Key
To register a security key, click Add a security key.
A modal window opens prompting you to enter a key nickname.
Example nicknames: YubiKey Office, iPhone Touch ID, Windows Hello.
Click Continue.
The browser displays a security prompt depending on the authenticator type:
Physical key: Insert and touch the key.
Touch ID: Place your finger on the sensor.
Face ID: Look at the camera.
Upon successful activation, the system confirms the registration.
You are automatically redirected to the Home page with your security key successfully added to your account.
System Constraints
Maximum 5 security keys per account
Each key must have a unique nickname per account
Business Benefits
Strongest authentication method
Phishing-resistant and cannot be intercepted
Deleting (Removing) a Security Key
Go to User settings → Account security → Security keys
View the list of registered security keys
Click Remove next to the desired key
Confirm deletion in the dialog
The key is immediately removed
Updated list shown in the interface
Post-Deletion Behaviour
If a user deletes their last remaining security key and has no other active 2FA method configured, they are automatically redirected to the 2FA Setup Page.
On that page, the user must configure a new Two-Factor Authentication method (such as an authenticator app or another security key) before continuing to access their account.
This safeguard ensures that the user always maintains at least one active 2FA method for secure authentication.
Using Security Keys for Authentication
During Initial Login (2FA Verification)
Enter username and password
The system displays authentication options based on the user’s enabled methods.
If the user’s 2FA flag is enabled and they have opted for both TOTP (authenticator app) and Security Key, both options Use authenticator app and Use security key will be shown.
If 2FA is disabled, the login flow proceeds as it does now.
If the user has enabled only one method (for example, Authenticator App), then only that option will be visible during login.
Select Use security key
Browser prompts for activation:
Physical key: Insert and touch
Touch ID/Face ID: Use biometric
System verifies key signature
User gains access