MFA-Duo - How to Register a USB Security Key

This document describes the process to register a USB Security Key for MFA-Duo.

Note: You will need the serial number of the device to complete registration. The serial number can be read from the back of the device and from a sticker placed on the packaging.

There are two stages of registering these devices. We recommend you register your USB device using the Google Chrome web browser to be able to complete the second stage of registration.

  1. Navigate to go.wisc.edu/token.

  2. Login with your NetID and password.

    • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

  3. Select "USB Security Key" from the list of device types.

    selection of three devices:  duo, otp c100, and USB Security Key

  4. You will be directed to Part 1 of the USB Security Key registration process.

    Follow the prompt to enter the USB Security Key Serial Number into the first input field. The serial number can be found on the back of your USB Security Key package.

    Part 1 of the registration process, with fields to enter in a securitiy key serial number and passcode, described in steps 4 through 7

  5. Plug the USB Security Key into a USB port or adapter.

    • Note: If this is the first time you are plugging the device into your computer, you may have to wait for driver software to finish installing.

    • Note: It may also open a keyboard dialogue box. Please close the dialogue box.

  6. Click inside the second text field under Step 3: Get a passcode from the USB Security Key then press the button on your device. The six-digit passcode should be entered automatically.

  7. Click Next.

  8. Your device has now been successfully registered! If you are a Chrome web browser user and would like a faster login experience, you may continue to enroll your USB device as a Security Key. Follow the steps below.


You must be using Google Chrome to continue.

    Part 2 of registration can only be done in chrome.  A prompt for duo authentication appears below the instructions

  1. Authenticate with a passcode.

    Click Enter a Passcode then tap the button on your USB device to generate the six-digit passcode. Click Login.

    duo prompt with a six digit passcode entered into the field

  2. Click +Add another device.

    List of devices, with token being the only one listed.  Option to add another device.

  3. Select Security Key from the device types. Click Continue.

    selection of three device types:  mobile phone, tablet, and security key

  4. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

    the only options here are back and continue

    pop-up window prompting the user to insert the device and tap the button

  5. Tap the button on your device to complete enrollment.

  6. You should now see both 'Token #NETID--' and 'Security Key (U2F) JUST ADDED' in the updated status screen, which indicates you have completed your USB Security Key registration.

    list of devices with token and security key listed as registered devices


The security key allows MFA-Duo users to insert the security key into the USB port of their computer or laptop to authenticate. This security key requires a reachable USB port, but this security key also works with a laptop or desktop USB to USB-C adaptor. The key is not compatible with mobile devices and only works with laptop or desktop computers. 

The security key experience is slightly different for the following modes of logging in: 

See below for details on these modes. 

Chrome web browser login 

When logging in to a UW–Madison website or apps using Chrome (version 70 or later), insert the security key into your USB port, select Security Key (U2F) from the device dropdown menu, and lightly touch the impressed sensor button to initiate login. 

Non-Chrome web browser or local software login

When logging into a UW–Madison website or app in Firefox or Safari, insert the security key into your USB port. Select Token from the device dropdown menu, and click the "Enter passcode" button to make the passcode input field editable. Then lightly touch the impressed sensor button to insert the passcode in the input field. If you are using a screen reader or other assistive technology, the security key may enter the passcode so quickly you may not hear the full code. The audio cue may only include the last digit of the code. Click the login button to complete authentication, as the full code should have populated the field. 

(See How to use a Feitian USB Security Key for more details and screenshots on the Chrome web browser login.)  

How to get a security key

Faculty and Staff New staff: Get a Feitian security key from your HR representative. Feitian security keys can also be picked up at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706. Current staff can get a Feitian security key at the Walk-In Help Desk at 1210 W. Dayton Street Madison, WI 53706. 

Students: Get a token or security key at no charge, at either the Walk-in Help Desk at 1210 W. Dayton St. or the pop-up Help Desks from early September through October 31, 2019. Locations and times for the pop-up Help Desks will be posted on the UW–Madison Events Calendar soon. After October 31, tokens or security keys can be picked up at the Walk-In Help Desk at 1210 W. Dayton St. For other assistance, contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.  

    See accessibility & usability information

    We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.

    If you would like to share your thoughts regarding the usability or accessibility of the MFA user experience, please use our Feedback Form. We appreciate your feedback.

    For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu.

    How to get access to a Security Key or Duo Token/Fob 

    Students

    Students can come to the DoIT Help Desk location at 1210 W. Dayton St., Madison, WI 53706 on the first floor of the Computer Science and Statistics Building or at the front desk of Ebling Library, located on the 2nd floor of the Health Sciences Learning Center (HSLC) located at 750 Highland Avenue. In addition, get help at dozens of DoIT Pop-Up Help Desks locations (access the Google doc using your NetID@wisc.edu). Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53751 on the 2nd floor.

    For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu

    Faculty, Staff, and Researchers

    Employees can get access to devices for MFA at their Human Resources Office. For questions contact the DoIT Help Desk at (608) 264-4357 or email help@doit.wisc.edu. 




    Keywords:key device password 2fa multi factor multifactor multi-factor two   Doc ID:90552
    Owner:Kyle A.Group:Multi-Factor Authentication (MFA)
    Created:2019-03-21 13:25 CSTUpdated:2019-08-20 15:06 CST
    Sites:DoIT Help Desk, DoIT Tech Store, Multi-Factor Authentication (MFA)
    Feedback:  0   0