YubiKey OTP

YubiKey OTP generates a 44-character one-time password when you touch the key. The gateway can validate these OTPs if Yubico credentials are configured.

Note

YubiKey OTP enrollment is not in the web UI or the CLI. It needs the Yubico credentials below and a call to POST /api/v1/auth/mfa/enroll/yubiotp/start with an OTP from the key.

Requirements

YubiKey OTP requires these gateway env vars:

YUBICO_CLIENT_ID=...
YUBICO_SECRET_KEY=...

Using YubiKey OTP

Once a YubiKey is enrolled, you can enter its OTP anywhere the gateway asks for an MFA code: the CLI’s code prompt, --mfa-code, or the web UI’s MFA prompt, which opens on a YubiKey OTP field when that’s your only factor and otherwise offers Use a YubiKey OTP. Touch the key with the cursor in the field; the key types the OTP and presses Enter.

Recommended Alternative

For most users, WebAuthn is easier to manage and fully supported in the UI:

• WebAuthn