Topics Map > Multi-Factor Authentication (MFA)

MFA-Duo - How to Register a USB Security Key

This document describes the process to register a USB Security Key for MFA-Duo.

Note: You will need the serial number of the device to complete registration. The serial number can be read from the back of the device or from a sticker placed on the packaging.

There are two stages of registering these devices. The first stage registers the device to be used as a hardware token and the second stage registers it to be used as a WebAuthn Authenticator.

  1. Navigate to

  2. Login with your NetID and password.

    • Note: If you've already registered a device and are using MFA Duo, you'll be prompted to login with your NetID twice, then be prompted for MFA Duo.

  3. Select "USB Security Key" from the list of device types.

    selection of three devices:  duo, otp c100, and USB Security Key

  4. You will be directed to Part 1 of the USB Security Key registration process.

    Follow the prompt to enter the USB Security Key Serial Number into the first input field. The serial number can be found on the back of your USB Security Key package.

    Part 1 of the registration process, with fields to enter in a securitiy key serial number and passcode, described in steps 4 through 7

  5. Plug the USB Security Key into a USB port or adapter.

  6. Click inside the second text field under Step 3: Get a passcode from the USB Security Key then press the button on your device. The six-digit passcode should be entered automatically.

  7. Click Next.

  8. Your device has now been successfully registered as a hardware token! 

The second stage of the process registers your device as a WebAuthn Authenticator.

registration - second stage

  1. Click the blue Duo Device Management Portal button. You will be asked to login with your NetID and password and authenticate with Duo once more.

  2. In the new tab that just opened, select the panel called Add a device.

    add new device

  3. Select Security key from the 'Select an option' window.

    security key

  4. Click Continue to bring up a popup window for enrolling your security key. The key will need to be plugged into a USB port on your computer.

    click continue

  5. Follow the prompts depending on your operating system and browser, then tap the button on your device to complete enrollment.


  6. You should now see both a Security key or Passkey in your Device Management Portal as well as a Hardware Token. These both represent your singular physical device registered as a Hardware token that can enter passcodes, as well as a WebAuthn Authenticator.

    security key and hardware token


See accessibility & usability information

We work with our users to address access and usability barriers in the MFA user experience. Learn details about known access barriers and workarounds at MFA-Duo - Accessibility & Usability Information. If you encounter a barrier or need assistance, please contact the DoIT Help Desk or call (608) 264-4357.

For questions regarding how to get access to the MFA mobile app contact the DoIT Help Desk at (608) 264-4357 or email

How to get access to a Security Key or Duo Token/Fob 


Students, to obtain a token/fob, please contact the DoIT Help Desk (608) 264-4357 or email Students with disabilities can also request a token or security key at the McBurney Disability Resource Center, 702 W. Johnson St., Suite #2104, Madison WI 53715 on the 2nd floor.

Faculty, Staff, and Researchers

Employees can get access to devices for MFA at their Human Resources Office or IT department. For questions contact the DoIT Help Desk at (608) 264-4357 or email 

Keywordskey device password 2fa multi factor multifactor multi-factor two   Doc ID90552
OwnerMST SupportGroupIdentity and Access Management
Created2019-03-21 14:25:29Updated2024-01-09 00:30:02
SitesDoIT Help Desk, Identity and Access Management
Feedback  1   2