> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # View and manage Passkey/FIDO2 tokens The **Passkey/FIDO2 Tokens** page provides a complete list of all passkeys and FIDO2 tokens registered by users in your tenant. Administrators can use this page to see which Passkey/FIDO2 tokens users enrolled and review the security profile of each device. Administrators do not add Passkey/FIDO2 authenticators to a user's list directly. Users must self-register their Passkey/FIDO2 token in the User Portal. If a Passkey/FIDO2 token is used for User ID sign-in, ensure the resource rule allows Passkey/FIDO2 authentication (see [Create and manage resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md)). note Only administrators assigned the **User Passkey/FIDO2 Token Management** permission can view and manage the Passkey/FIDO2 Tokens list. ## View the Passkey/FIDO2 Tokens page 1. Click Menu icon **>** **Resources** **>** **Passkey/FIDO2 Tokens**. The **Passkey/FIDO2 Tokens** page appears. > The **Passkey/FIDO2 Tokens** page lists all registered Passkey/FIDO2 tokens across the tenant. Each row represents a single registered passkey or FIDO2 token associated with a user. > > For a description of the table in the **Passkey/FIDO2 Tokens** page, see [Passkey/FIDO2 Tokens table](#passkeyfido2-tokens-table). 2. Click the **expansion icon** (▶) next to a Passkey/FIDO2 token to see the Passkey/FIDO2 token details. - For a description of the Passkey/FIDO2 token details fields, see [Passkey/FIDO2 token details](#passkeyfido2-token-details). - For more information on the authenticator metadata source, see [Authenticator metadata overview](#authenticator-metadata-overview). 3. Click Search icon to enable filtering. For a description of the available filters, see [Available filters](#available-filters). 4. To clear all applied filters at once, click the **Reset** button in the filter sidebar. You can also remove individual filter values one at a time. 5. Do the following as required to manage an individual Passkey/FIDO2 token from the **Passkey/FIDO2 Tokens** page. - Click **Disable** (Square icon) to temporarily deactivate a Passkey/FIDO2 token and confirm the prompt. The Passkey/FIDO2 token record is retained, but the user cannot use it to authenticate until it is re-enabled. - Click **Enable** (Play icon) and confirm the prompt to activate a previously disabled Passkey/FIDO2 token, allowing the user to authenticate with it again. - Click **Delete** (Trash icon) and confirm the prompt to delete a Passkey/FIDO2 token. 6. To perform multi-token actions, see [Multi-token actions](#multi-passkeyfido2-token-actions). ## Manage Passkey/FIDO2 tokens from the Users page You can also manage an individual user's Passkey/FIDO2 tokens from the **Users** page. 1. Click Menu icon **>** **Members > Users**. 2. Select the user you want to manage. 3. Click the **Authenticators** tab. 4. In the Passkey/FIDO2 token row, click **Actions** (Ellipsis Vertical icon) and select from the following as required: - **Enable** to reactivate a Passkey/FIDO2 token. - **Disable** to disable a Passkey/FIDO2 token. - **Rename** to give the Passkey/FIDO2 token a new name. - **Details** to see the Passkey/FIDO2 token details. - **Delete** to delete the Passkey/FIDO2 token. ### Passkey/FIDO2 tokens table | Column | Description | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Status** | Indicates whether the Passkey/FIDO2 token is currently **Active** or **Disabled**. | | **Passkey Name** | A custom name provided by the user before initiating the passkey registration. It helps identify the Passkey/FIDO2 token in the list. | | **Authenticator** | The name and type of authenticator used, for example, **Windows Hello VBS Hardware Authenticator**, **Apple Passwords**, **YubiKey**. This can be a **Platform Authenticator** (built into the device) or a **Roaming Authenticator** (external hardware key). | | **User ID** | The unique user ID of the user who registered this Passkey/FIDO2 token. | | **FIDO Certification** | Indicates whether the authenticator is certified by the [FIDO Alliance](https://fidoalliance.org/). Certified authenticators meet strict security standards. | | **Synced** | Shows whether the Passkey/FIDO2 token is **synced** (backed up to cloud and available across devices) or **device-bound** (exists only on the original device). | | **Date Added** | The date and time when this Passkey/FIDO2 token was registered. | | **Date Last Used** | The date and time when this Passkey/FIDO2 token was last used to authenticate. | | **Actions** | Available actions for the Passkey/FIDO2 token. See [Authenticator metadata overview](#authenticator-metadata-overview). | ### Passkey/FIDO2 token details | Field | Description | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Algorithm** | The cryptographic algorithm used by the Passkey/FIDO2 token (for example, RS256, ES256). This determines how the authentication signature is generated and verified. | | **Authenticator ID (AAGUID)** | A unique identifier (AAGUID) that identifies the make and model of the authenticator device. This is assigned by the authenticator manufacturer and helps determine which device type was used during registration. | | **Relying Party ID** | The domain or application identifier that this Passkey/FIDO2 token is bound to. A passkey registered for one application cannot be used to authenticate on a different one. | | **Key Protection** | Describes how the private key is stored on the device. For example, a key stored in a **hardware security chip (TEE or Secure Element)** is highly protected and cannot be extracted. A **software-protected** key is stored in the device's memory and may be less secure. | | **Matcher Protection** | Describes where the user verification check (such as a fingerprint scan or PIN entry) is processed. If processed inside a **secure hardware chip**, it is tamper-resistant. If processed in **software**, it relies on the operating system for security. | | **Transport Method** | The communication channel the authenticator uses to interact with the browser or device. Common values include **USB** (plugged in), **NFC** (tap to authenticate), **BLE** (Bluetooth), and **Internal** (built into the device). | | **Feature Flags** | Indicates the security properties confirmed during authentication: **User Present** (the user physically interacted with the device), **User Verified** (the user completed a verification step such as biometric or PIN), and **Backup Eligible** (the passkey can be synced or backed up to the cloud). | For definitions of all these fields and their possible values, refer to the [Glossary](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators/manage-passkey-fido2-tokens/glossary.md). ### Authenticator metadata overview IDaaS resolves authenticator details using the [FIDO Metadata Service](https://fidoalliance.org/metadata/) (MDS) blob: an official, signed list of authenticator metadata published by the FIDO Alliance. It includes device details and certification status for authenticators that have passed FIDO certification requirements. On each new passkey registration, IDaaS follows this process: 1. Checks whether a newer MDS blob is available from the FIDO Alliance. If one is available, the local blob is updated. 2. Looks up the registering authenticator by its **AAGUID** in the updated blob. 3. If a matching record is found, IDaaS updates the authenticator's stored metadata (name, certification status, key protection, matcher protection, and so on). 4. If no record exists yet for that AAGUID, IDaaS creates a new authenticator metadata record. ### Authenticators not listed in FIDO MDS Some authenticators are not included in the public MDS blob. For these, IDaaS falls back to a locally maintained metadata repository. This repository provides only a name and icon for each authenticator. The following fields are not available for authenticators sourced from the local repository: - Key Protection - Matcher Protection - FIDO Certification For the full list of supported authenticators and their icons, see [Community authenticator list](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators/manage-passkey-fido2-tokens/community-authenticators.md). ## Available filters | Filter | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------ | | **Status** | Filter Passkey/FIDO2 tokens by their current state: **Active** or **Inactive**. | | **Passkey Name** | Search by the custom name the user provided during passkey registration. | | **Authenticator Name** | Filter by the name of the authenticator device (for example, Windows Hello, Apple Passwords, YubiKey). | | **User ID** | Search for tokens registered by a specific user using their unique user ID. | | **Date Added** | Filter tokens by the date they were registered. You can specify a date range. | | **Last Used Date** | Filter tokens by the date they were last used for authentication. You can specify a date range. | ## Multi-Passkey/FIDO2 token actions You can select multiple Passkey/FIDO2 tokens using the **row selection checkboxes** at the start of each row. Once you select one or more Passkey/FIDO2 tokens, the following actions are available for all selected Passkey/FIDO2 tokens: | Action | Description | | -------------------- | -------------------------------------------------------------- | | **Enable selected** | Enables all selected Passkey/FIDO2 tokens at once. | | **Disable selected** | Disables all selected Passkey/FIDO2 tokens at once. | | **Delete selected** | Permanently deletes all selected Passkey/FIDO2 tokens at once. | warning Deleting selected Passkey/FIDO2 tokens is **irreversible**. Verify your selection carefully before confirming. ### When to use these actions | Scenario | Recommended Action | | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | User lost their hardware key | **Delete** the associated Passkey/FIDO2 token. | | User's device is temporarily unavailable | **Disable** the Passkey/FIDO2 token until the device is back. | | Suspicious authentication activity on a Passkey/FIDO2 token | **Disable** immediately and investigate. | | Offboarding a user | **Delete selected** Passkey/FIDO2 tokens associated with that user. | | Enforcing a new security policy (for example, no synced passkeys) | Filter synced Passkey/FIDO2 tokens and **Disable selected** or **Delete selected**. | ## Validate your changes After you perform token actions, verify the following: 1. The selected token rows show the expected state. 2. Disabled tokens cannot be used for authentication. 3. Deleted tokens no longer appear in the Passkey/FIDO2 token list. 4. Any renamed token shows the updated name in both list and user details views.