# FIDO2 key

> Register a FIDO2 security key or a passkey for a user from the Ironchip admin console and test passwordless authentication.

URL: https://docs.ironchip.com/en/identidad/usuarios/fido2/

FIDO2 is a passwordless authentication standard based on public-key cryptography. The private key is stored in the authenticator, for example a physical security key, and is never shared with the service. This protects against phishing attacks and credential leaks.

## Generate the FIDO2 key

To register a FIDO2 key from the admin console, follow these steps:

1. Go to the Ironchip admin console: [app.ironchip.com](https://app.ironchip.com).
2. In the left side menu, go to **Directory > Users**.

   [Image: Console side menu with the Directory and Users options]

3. Find the user you want to assign the FIDO2 key to, click **Options** and select **Register a passkey**.

   [Image: Options menu of a user with the Register a passkey option]

4. The user receives an email to register their passkey. In the email, click the button to register the passkey (**Registrar clave de acceso** in the screenshot, which shows the email in Spanish).

   [Image: Email with the button to register the passkey]

5. Type a name to identify the key.

   [Image: Field to type the name of the key]

6. Click the button to register the passkey (**Registrar passkey** in the screenshot).

   [Image: Passkey registration page with the key name and the register button]

7. A window asks for the authenticator PIN. Enter it and continue (**Siguiente** in the screenshot).

   [Image: Window asking for the authenticator PIN]

8. If everything went well, the FIDO2 key is registered.

   [Image: Confirmation message that the FIDO2 key is registered]

You can see all the keys created in the admin console, under **Directory > Devices > Passkeys**:

[Image: Console side menu with Directory, Devices and Passkeys highlighted]

The list of all the keys created appears there.

[Image: List of the FIDO2 keys created]

## Test it

For the test, set **Any FIDO2 devices** as the authentication method of the access. In the **Add a new access** window, at the **Select authentication policies** step, add it under **Configure authentication factors**.

[Image: Add a new access window with Any FIDO2 devices as the authentication factor]

The video shows what authentication with FIDO2 looks like.

Video: [Authentication with a FIDO2 key](https://play.hubspotvideo.com/v/7745202/id/223207412075)