YubiKey vs Token2

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   YubiKey—none0/10

   Direct probes confirm no llms.txt or agent-oriented docs exist on any Yubico domain (404s across docs.yubico.com, developers.yubico.com, www.yubico.com), and no MCP endpoint resolves; documentation is human-oriented HTML only.

   • [probe] “PROBE llms.txt: HTTP 404 at https://docs.yubico.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://docs.yubico.com/.md”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”

   proof ↗⚑ flag

   Token2—none0/10

   Direct probes show no llms.txt (404) and no markdown-accessible docs (404), and no OpenAPI/agent-oriented documentation exists; Token2 is a hardware security key vendor with no evidence of agent-discoverable docs.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   YubiKey~partialprobed4/10

   Yubico ships scriptable tooling (ykman CLI, python-fido2 SDK) that can configure/query keys programmatically in scripts or CI pipelines, and a fleet REST API for enterprise management — but the core authentication function inherently requires physical touch/user presence, which cannot be automated headlessly. Missing for 10: any documented way to perform actual FIDO2/PIV/OATH authentication or signing operations without a human touch event, explicit CI/automation guidance, and evidence of true headless operation for the security-critical path (only configuration/management is scriptable).

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [claimed-docs] “FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN …”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 ships a PowerShell bulk-enrollment script (fido2_bulkenroll_entraid) that could in principle be scripted/automated, and fido2-manage exposes some command-line-style operations (PIN, SSH key management) beyond its Python/tkinter GUI, suggesting some automation potential. However, the flagship tool is explicitly GUI-based and requires physical FIDO2 hardware interaction over USB/NFC, and there is no documented headless mode, CI integration, or automation-focused CLI/API (no OpenAPI, no llms.txt, no CI examples). Missing for 10: dedicated headless/CI-mode documentation, evidence of non-interactive scripted runs without physical key presence, and any CI/pipeline integration guide.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”

   proof ↗⚑ flag

3. ai-native userUse an official CLI

   weight 2 · round to YubiKey
   YubiKey~partialprobed6/10

   YubiKey ships an official CLI (ykman/yubikey-manager) for device configuration, verified installable via pip/uvx and Homebrew with scriptable device management, but this is a hardware-configuration tool, not an AI-agentic CLI designed for LLM/agent workflows — there's no evidence of AI-native features like structured output for agents, agent-oriented docs, or MCP integration. missing for 10: evidence of AI-agent-oriented usage patterns, structured/machine-readable output tailored for agentic consumption, and any llms.txt/MCP support (explicitly absent per probes).

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [probe] “official CLI documented at https://developers.yubico.com/yubikey-manager/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 publishes official open-source tools (fido2-manage, fido2_bulkenroll_entraid) that expose scriptable command operations (list/delete/generate/upload for keys, PIN, biometrics, SSH) usable from the command line, and the PowerShell bulk-enroll tool is inherently a CLI-style utility, but neither is explicitly branded or documented as an 'official CLI' for AI-native/agentic workflows — the flagship fido2-manage tool is described primarily as a GUI (Python/tkinter) application with underlying scriptable functions rather than a dedicated documented CLI interface. Missing for 10: explicit CLI documentation/binary/flags, examples of scripting/automation for AI agents, and independent confirmation the tool is used headlessly.

   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”

   proof ↗⚑ flag

4. ai-native userDrive the product through a documented public API

   weight 3 · round to YubiKey
   YubiKey~partialprobed5/10

   YubiKey exposes genuine programmatic interfaces — the ykman CLI, python-fido2 SDK, PKCS#11/PIV/OpenPGP libraries, and platform SDKs (Android/iOS/.NET) — that let a developer or automated agent drive the device (yubikey-docs-4, yubikey-probe-rt-1, yubikey-probe-rt-3, yubikey-docs-8, yubikey-docs-19). There is also a separate REST API for YubiEnterprise fleet management (yubikey-probe-rt-2). However, there is no unified public REST/OpenAPI spec for the core device (probe-3 confirms 404s), and no AI-agent-oriented discovery layer like llms.txt or MCP (yubikey-probe-1, yubikey-probe-rt-4). Missing for 10: a documented OpenAPI/REST spec for core device operations, and any llms.txt/MCP support for AI-agent consumption.

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”
   • [claimed-docs] “It enables RSA or ECC sign/encrypt operations using a private key stored on a smartcard (such as the YubiKey), through common interfaces lik…”
   • [claimed-docs] “The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor; probes explicitly show no public API, no OpenAPI/Swagger spec, and no llms.txt (404s across all checked endpoints). Its tools (fido2-manage CLI, GUI, browser demos) are device-management utilities over USB/NFC/WebAuthn, not a documented public API for programmatic/agentic control.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”

   proof ↗⚑ flag

5. ai-native userBuild against official SDKs

   weight 2 · round to YubiKey
   YubiKey✓fullprobed8/10

   Yubico publishes and maintains a broad set of official SDKs (python-fido2, java-webauthn-server, .NET SDK, YubiKit Android/iOS, ykman CLI) with dedicated docs, and runtime probes confirm these packages are live and installable from public registries (PyPI, Homebrew) rather than just claimed in docs. This gives developers, including AI-native builders, real programmatic building blocks for passkeys/FIDO2/PIV integration. Missing for 10: no AI-agent-specific SDK examples or agent-oriented tooling, and no independent (non-Yubico) hands-on validation of SDK developer experience.

   • [claimed-docs] “Provides library functionality for communicating with a FIDO device over USB as well as verifying attestation and assertion signatures.”
   • [claimed-docs] “The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
   • [claimed-docs] “YubiKit is an Android library provided by Yubico to enable YubiKey support in Android apps. Both USB and NFC-enabled YubiKeys are supported.”
   • [claimed-docs] “The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-ena…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”
   • [claimed-docs] “Provides implementations of the Relying Party operations required for a server to support Web Authentication, including passkey authenticati…”

   proof ↗⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   YubiKey—none0/10

   Evidence shows YubiKey's developer docs are static HTML references (SDK guides, protocol explanations) rather than an interactive, runnable API console; explicit probes for OpenAPI/Swagger specs return 404 and no llms.txt/MCP endpoint exists. The only REST API surface found (YubiEnterprise apidocs) is confirmed live but with no evidence of runnable/try-it-out examples.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with no evidence of an API reference at all — the probes explicitly show no OpenAPI/swagger spec exists (404s across all candidate paths) and no llms.txt or docs.md exposure. There's no indication of an interactive, runnable API explorer anywhere in the evidence.

   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   YubiKey—none0/10

   Explicit probes for OpenAPI/Swagger specs at docs.yubico.com and developers.yubico.com all returned 404s, and no llms.txt or machine-readable API spec was found anywhere in Yubico's domains. While a YubiEnterprise REST API console exists, there is no evidence it is exposed as a downloadable OpenAPI/machine-readable spec.

   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with desktop/browser tools and a CLI, but there is no evidence of a machine-readable API spec; explicit probes for OpenAPI/Swagger endpoints and llms.txt all returned 404.

   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   YubiKey—none0/10

   YubiKey ships multiple SDKs and a REST API (YubiEnterprise) plus CLI tools, so the axis of API stability/versioning is applicable, but nothing in the evidence pack documents a versioning scheme or deprecation policy for any of these surfaces — firmware version references (yubikey-docs-15/25) concern hardware firmware, not API contracts, and probes found no OpenAPI spec or changelog.

   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitiv…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/…”

   proof ↗⚑ flag

   Token2—none0/10

   Token2 is a hardware security key vendor with desktop/CLI tools for FIDO2/PIV management; there is no evidence of any versioned public API, and probes confirm no OpenAPI/Swagger spec exists (404s across all candidate paths). No documentation of API versioning or deprecation policy is present anywhere in the evidence.

   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://www.token2.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://www.token2.com/site/page/tools-for-fido-security-keys.md”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Token2
   YubiKey~partialprobed4/10

   Yubico exposes a scriptable CLI (ykman) and a YubiEnterprise fleet-management REST API that could be used to configure or manage many keys programmatically, hinting at bulk-capable automation, but no docs explicitly describe a bulk/batch operation (e.g., configuring N keys or revoking many credentials in one call). Missing for 10: explicit bulk-operation API/CLI documentation, batch examples, and independent confirmation that many items can be processed in one automated action.

   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [claimed-docs] “Configure your YubiKey via the command line.”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2 provides fido2_bulkenroll_entraid, a dedicated PowerShell tool for bulk-provisioning FIDO2 keys into Entra ID, and fido2-manage is a scriptable CLI (list/delete/edit passkeys, PIN and bio-template management, SSH key handling) that can be run in loops/scripts to act across many devices. This is real automation-depth for security-key/credential management but is narrow in scope (security keys/passkeys, one specific IdP integration) rather than a general bulk-operations API. Missing for 10: a general-purpose bulk API/SDK, documented batch endpoints beyond the Entra-specific script, and independent evidence of large-scale bulk use in production.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Openpgp

1. developerKeep OpenPGP keys on the device and use them for git commit signing and encrypted email

   weight 2 · round to YubiKey
   YubiKey✓fullcommunity7/10

   Yubico's own docs describe OpenPGP support with RSA/ECC sign/encrypt operations using a private key stored on the YubiKey smartcard (yubikey-docs-9, yubikey-docs-26), and independent community testimony confirms real-world use of YubiKey's GPG smartcard functionality (contrasted with competitors lacking it) (yubikey-comm-14, yubikey-comm-15). This covers the underlying capability for git commit signing (via GPG) and encrypted email (via OpenPGP), though neither specific workflow (git config, email client integration) is explicitly documented in the pack. Missing for 10: explicit git commit-signing walkthrough/documentation, explicit encrypted-email (e.g., Enigmail/Thunderbird) setup guide, and more first-party depth beyond the general OpenPGP overview.

   • [claimed-docs] “OpenPGP is an open standard for signing and encrypting. It enables RSA or ECC sign/encrypt operations using a private key stored on a smartc…”
   • [claimed-docs] “It enables RSA or ECC sign/encrypt operations using a private key stored on a smartcard (such as YubiKeys), through common interfaces like P…”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”
   • [community] “Unfortunately SoloKey doesn't work as an OpenPGP smart card, which means it's not a real substitute for a Yubikey.”

   proof ↗⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Otp

1. power userThe key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn

   weight 2 · round to YubiKey
   YubiKey✓fullcommunity8/10

   YubiKey natively supports OATH TOTP/HOTP slots (with secrets stored in the secure element) and Yubico OTP/challenge-response via the OTP application, documented and manageable via ykman/Yubico Authenticator, covering legacy services without WebAuthn. Community evidence corroborates real-world use of these legacy modes alongside FIDO2. Missing for 10: independent hands-on walkthrough of setting up HOTP/TOTP slots or challenge-response specifically, and more detail on slot capacity/limits.

   • [claimed-docs] “the shared secrets are stored and processed in the YubiKey's secure element”
   • [claimed-docs] “No client software needed. The OTP is just a string. If you can send a password, you can send an OTP.”
   • [claimed-docs] “The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-ena…”
   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”

   proof ↗⚑ flag

   Token2—none0/10

   The evidence only shows a browser-based TOTP toolset (docs-4, docs-6) and Entra ID seed export, unrelated to the FIDO2 security key itself carrying TOTP/HOTP slots or challenge-response capability; no documentation shows the hardware key supports legacy OTP protocols. Missing for 10: any spec sheet or docs stating the key itself implements TOTP/HOTP slots, challenge-response mode, or dual-protocol firmware.

   • [claimed-docs] “Generate and verify TOTP codes entirely in your browser. Algorithm: SHA-1. All computation happens locally — no seed is ever sent to a serve…”
   • [claimed-docs] “Export the current seed as an Entra ID hardware-token import file (CSV or JSON).”

   proof ↗⚑ flag

Piv

1. it adminThe key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device

   weight 2 · round to YubiKey
   YubiKey✓fullcommunity7/10

   Docs confirm PIV smart-card functionality (PKCS#11 sign/encrypt with on-device RSA/ECC keys, non-exportable, with attestation to prove device-generated keys), and community independently corroborates real-world PIV smart-card use (yubikey-comm-16, yubikey-comm-14). This covers certificate-based login and code-signing capability, though the workstation-login and VPN integration flows themselves aren't explicitly documented in this pack. Missing for 10: explicit docs/screenshots of Windows/macOS smart-card workstation sign-in setup, VPN client PIV integration guides, and a dedicated code-signing walkthrough.

   • [claimed-docs] “It enables RSA or ECC sign/encrypt operations using a private key stored on a smartcard (such as the YubiKey), through common interfaces lik…”
   • [claimed-docs] “The concept of attestation is used to show that a certain asymmetric key has been generated on device and not imported.”
   • [claimed-docs] “This certificate should be used for the purpose of verifying that the key was generated in device.”
   • [community] “Also, yubikey works as a PIV smartcard.”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”

   proof ↗⚑ flag

   Token2~partialclaimed5/10

   Token2 documents PIV support via a Windows miniDriver and macOS Companion App enabling smartcard-based certificate enrollment and login with on-prem AD, which covers workstation sign-in use cases. However, there is no evidence for VPN integration or code signing use cases specifically, nor independent/hands-on verification of PIV certificate workflows beyond vendor docs. missing for 10: VPN certificate-auth evidence, code-signing use case evidence, independent/hands-on validation of PIV smartcard login, detail on key non-exportability guarantees for PIV certs.

   • [claimed-docs] “Using the Windows miniDriver, users can manage essential PIV functions such as PIN setup, PIN changes, and basic card configuration.”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”

   proof ↗⚑ flag

Ssh

1. developerMy SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch

   weight 2 · round to YubiKey
   YubiKey✓fullcommunity9/10

   Yubico documents all three hardware-backed SSH paths: FIDO2 sk-ssh keys generated on-device with OpenSSH (private key never leaves hardware, touch required per operation), PIV smartcard usage via PKCS#11 for sign/encrypt with SSH, and OpenPGP smartcard keys for SSH auth. Community corroboration confirms FIDO2/PIV/OpenPGP smartcard functionality and touch-to-sign is genuinely enforced (not remotely bypassable). Missing for 10: no independent hands-on benchmark of ed25519 sk-ssh key generation end-to-end, and some community friction noted around PIN/touch UX onboarding.

   • [claimed-docs] “FIDO2 security keys, such as the YubiKey, strengthen SSH security by ensuring your private SSH keys never leave the hardware security key.”
   • [claimed-docs] “FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN …”
   • [claimed-docs] “It enables RSA or ECC sign/encrypt operations using a private key stored on a smartcard (such as the YubiKey), through common interfaces lik…”
   • [claimed-docs] “OpenPGP is an open standard for signing and encrypting. It enables RSA or ECC sign/encrypt operations using a private key stored on a smartc…”
   • [claimed-docs] “you can generate the private key directly on the hardware, where it cannot be exported or extracted”
   • [claimed-docs] “This guide shows how to generate and use SSH keys directly on your FIDO2 security key with OpenSSH.”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”
   • [community] “Also, yubikey works as a PIV smartcard.”
   • [community] “The whole point of this touch to sign is that it can't be hacked remotely :) and you can just turn it off for most modes.”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2's fido2-manage tool explicitly supports SSH security keys (generate, list resident, download/rehydrate, ssh-copy-id, add to local ssh-agent), directly evidencing FIDO2 sk-ssh hardware-backed key workflows. PIV is also supported via the Windows miniDriver and Companion App for smartcard-based certificate enrollment, but there is no mention of OpenPGP support for SSH auth. missing for 10: OpenPGP-based SSH key support, independent/hands-on verification of the sk-ssh workflow, and cross-platform PIV parity beyond Windows/macOS.

   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “Using the Windows miniDriver, users can manage essential PIV functions such as PIN setup, PIN changes, and basic card configuration.”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Agent audit

1. ai-native userAn agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet

   weight 2 · round to YubiKey
   YubiKey✓fullprobed8/10

   Yubico's official ykman CLI (and underlying python-fido2/yubikey-manager libraries) exposes exactly this data programmatically: serial number, firmware version, enabled applications, PIN/PIV/OATH/OTP slot state, all scriptable without a client GUI — confirmed both in docs (docs-4, docs-15/25) and a keyless runtime probe showing full scriptable device management (probe-rt-1) plus SDK availability on PyPI (probe-rt-3). An agent can shell out to ykman on each key to build a fleet audit, though Yubico provides no built-in cross-fleet aggregation/reporting endpoint (the YubiEnterprise API in probe-rt-2 covers shipping/inventory, not live security-posture state). Missing for 10: a native fleet-wide audit/reporting API or dashboard aggregating multiple keys' state, and independent hands-on confirmation of scripting this across many devices at scale.

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitiv…”
   • [probe] “official CLI documented at https://developers.yubico.com/yubikey-manager/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2's open-source fido2-manage CLI/GUI tool (scriptable over USB/NFC) can view device information, list resident credentials (passkeys) with user handle, manage PINs, and enumerate biometric templates — giving an agent a scriptable path to audit key state across a fleet. However, no evidence documents reading serial numbers, firmware version, or 'enabled applications' specifically, nor is there a structured/JSON API, OpenAPI spec, or llms.txt for machine-readable output (confirmed 404s), so agent-friendly programmatic access is only partially evidenced. Missing for 10: documented serial/firmware-version fields, explicit 'enabled applications' enumeration, and a structured machine-readable output/API for agent consumption.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Attestation

1. security engineerVerify device attestation at registration to enforce that only genuine, approved key models are enrolled

   weight 2 · round to YubiKey
   YubiKey✓fullprobed8/10

   YubiKey documents PIV attestation explicitly: certificates prove a key was generated on-device (not imported), and python-fido2 provides library support for 'verifying attestation and assertion signatures,' enabling backend registration flows to reject non-genuine or imported keys. This directly supports enforcing genuine device enrollment at registration time. Missing for 10: no independent/hands-on validation of attestation-based enrollment enforcement in production, and no explicit vendor-model allowlisting guide beyond the raw attestation cert mechanism.

   • [claimed-docs] “The concept of attestation is used to show that a certain asymmetric key has been generated on device and not imported.”
   • [claimed-docs] “This certificate should be used for the purpose of verifying that the key was generated in device.”
   • [claimed-docs] “Provides library functionality for communicating with a FIDO device over USB as well as verifying attestation and assertion signatures.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”

   proof ↗⚑ flag

   Token2~partialclaimed3/10

   Token2 provides an AAGUID lookup tool to identify certified authenticators and a WebAuthn registration demo, which touch on device identification, but there is no documented mechanism for verifying attestation certificates or enforcing an allow-list of approved key models at registration. missing for 10: attestation certificate chain validation, FIDO Metadata Service integration, documented enterprise enrollment policy enforcement.

   • [claimed-docs] “Look up any certified authenticator by name or AAGUID — no key required.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”

   proof ↗⚑ flag

Cli

1. developerConfigure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably

   weight 3 · round to YubiKey
   YubiKey✓fullprobed9/10

   ykman is Yubico's official CLI for configuring YubiKeys — enabling/disabling applications, setting PINs, managing PIV/OATH/OTP slots, and reading device/firmware state — and is documented and verified installable/scriptable via pip/Homebrew/uvx in runtime probes. Independent community mentions corroborate real-world use of ykman-adjacent workflows (e.g., PIN enrollment via CLI/GUI tools). Missing for 10: no independent hands-on developer review specifically praising ykman's scripting ergonomics beyond install verification.

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [probe] “official CLI documented at https://developers.yubico.com/yubikey-manager/”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [community] “This part can be frustrating for a novice adopting security keys. The key works out of the box without PIN. If you didn't come across the ri…”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   fido2-manage is an official open-source Token2 tool that supports PIN set/change, resident-credential (passkey) and biometric slot management, and device info viewing, and a probe confirms it is documented as a CLI, giving genuine scriptable control over FIDO2 keys. However most docs describe it primarily as a Python/tkinter GUI rather than a dedicated CLI, and there's no explicit mention of an 'enable applications' feature or comprehensive CLI usage examples/API reference. missing for 10: explicit CLI command reference/examples, 'enable applications' capability, independent hands-on CLI scripting confirmation.

   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Sdks

1. developerOfficial SDKs let me integrate the key into my own desktop and mobile apps

   weight 2 · round to YubiKey
   YubiKey✓fullprobed8/10

   Yubico provides official desktop SDK (.NET SDK, yubikey-manager), Android (YubiKit) and iOS (yubikit-ios) mobile SDKs, plus python-fido2 and java-webauthn-server libraries, all documented and confirmed live on package registries. missing for 10: independent third-party developer testimonials on ease of SDK integration, and no official cross-platform (e.g. Flutter/React Native) SDK is mentioned.

   • [claimed-docs] “Yubico has developed a range of mobile SDKs, such as for iOS and Android, and also desktop SDKs to enable developers to rapidly integrate ha…”
   • [claimed-docs] “The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
   • [claimed-docs] “YubiKit is an Android library provided by Yubico to enable YubiKey support in Android apps. Both USB and NFC-enabled YubiKeys are supported.”
   • [claimed-docs] “The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-ena…”
   • [claimed-docs] “Provides library functionality for communicating with a FIDO device over USB as well as verifying attestation and assertion signatures.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”

   proof ↗⚑ flag

   Token2—none0/10

   Evidence shows only management/admin tools (fido2-manage GUI/CLI, bulk enrollment for Entra ID, browser-based WebAuthn demo) rather than an official SDK or library for embedding the key's authentication into a developer's own desktop/mobile applications. No mention of a downloadable SDK, API bindings, or mobile library is found anywhere in the pack.

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”

   proof ↗⚑ flag

Agent approval

1. ai-native userRequire a physical key touch as the human-approval step for sensitive automated or agent-initiated actions

   weight 1 · round to YubiKey
   YubiKey~partialprobed4/10

   YubiKey's FIDO2/WebAuthn and SSH implementations require a physical touch for every cryptographic operation, and SDKs like python-fido2, PKCS#11, and yubikey-manager expose this as a programmable building block that could be wired into an agent approval flow, but there is no evidence of any actual AI-agent or automation-approval integration built on this. missing for 10: any documented agent-framework integration, a sample workflow gating an AI or agent action behind YubiKey touch, or a third-party report of this pattern in use.

   • [claimed-docs] “FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN …”
   • [claimed-docs] “you can generate the private key directly on the hardware, where it cannot be exported or extracted”
   • [claimed-docs] “This guide shows how to generate and use SSH keys directly on your FIDO2 security key with OpenSSH.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager…”
   • [community] “The whole point of this touch to sign is that it can't be hacked remotely :) and you can just turn it off for most modes.”

   proof ↗⚑ flag

   Token2—none0/10

   Token2's evidence covers FIDO2 key management, PIV, TOTP tools, and WebAuthn demos, but nothing shows integration with AI agents or automated workflows that would use a physical touch as an approval gate for agent-initiated actions. Missing for 10: any documentation of agent/automation integration, an approval-step API or SDK, or a workflow example tying physical touch to AI-agent action authorization.

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”

   proof ↗⚑ flag

Compatibility

1. power userThe key works across my operating systems and browsers, with a published compatibility catalog of supported services

   weight 2 · round drawn
   YubiKey~partialcommunity5/10

   Docs show broad standards-based compatibility (FIDO2/WebAuthn, PIV, OpenPGP, OTP, SSH) and SDKs for iOS, Android, .NET, and desktop, implying cross-OS/browser support, and community posts confirm real-world use across GPG/PIV/SSH/WebAuthn workflows. However, there is no evidence of a published, browsable compatibility catalog listing specific supported services/websites or a browser support matrix as the story requests. Missing for 10: an explicit 'works with' directory of supported services/sites, and a documented OS/browser compatibility matrix beyond protocol-level claims.

   • [claimed-docs] “the WebAuthn API enables servers to register and authenticate users using public key cryptography instead of a password”
   • [claimed-docs] “this guide will provide all the necessary technical knowledge required to adopt passkeys into your application”
   • [claimed-docs] “The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
   • [claimed-docs] “YubiKit is an Android library provided by Yubico to enable YubiKey support in Android apps. Both USB and NFC-enabled YubiKeys are supported.”
   • [claimed-docs] “The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-ena…”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”
   • [community] “Also, yubikey works as a PIV smartcard.”

   proof ↗⚑ flag

   Token2~partialclaimed5/10

   Evidence shows solid cross-OS/browser support (Windows control panel, Chromium browsers, macOS/Linux companion app, PIV miniDriver) and manufacturer-agnostic FIDO2.1 tooling, but there is no published catalog listing which third-party services/relying parties are certified compatible with Token2 keys. missing for 10: a published service/RP compatibility catalog, independent cross-browser/OS corroboration beyond vendor docs.

   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “If you are using macOS or Linux, you can manage your FIDO2 keys using the tool integrated into the latest Chromium based browsers, such as G…”
   • [claimed-docs] “You can use the standard Windows control panel tool to manage your key, as long as you run Windows 10 build 1903 or later.”
   • [claimed-docs] “PIV features can be configured using our all-in-one management tool, the Companion App, which is now also available on macOS.”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”

   proof ↗⚑ flag

Recovery

1. security engineerThe vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost

   weight 3 · round to Token2
   YubiKey—none0/10

   The evidence pack contains no vendor documentation describing a lockout-recovery strategy (e.g., backup key enrollment guidance, what's recoverable vs. not). Community threads instead highlight the opposite experience — users must manually track and re-register every account per lost key with no central mechanism (yubikey-comm-7), and lost/compromised keys require full manual replacement across all enrolled services (yubikey-comm-2, yubikey-comm-6) — indicating this is an unaddressed gap rather than a documented workflow.

   • [community] “I have redundant keys for backup access. But I have no idea which accounts I used the lost key for, in order to log into them one by one to …”
   • [community] “I think the most annoying part of this is that you cannot just replace a YubiKey. You need to manually go through each account and replace t…”
   • [community] “They really should [issue replacements]. The recovery of the one secret the device is supposed to keep is catastrophic. Sure, the recovery i…”

   proof ↗⚑ flag

   Token2~partialclaimed3/10

   Token2's FAQ includes a 'How Do I Set Up a Backup Key?' entry, indicating some guidance exists, but the evidence pack contains no actual content on what is/isn't recoverable if a key is lost (e.g., resident credentials, PINs, biometrics, or TOTP seeds). Missing for 10: detailed recovery/lockout policy content, explicit statement of non-recoverable data (e.g., resident key private keys), and any independent corroboration of the backup-key workflow.

   • [claimed-docs] “How Do I Set Up a Backup Key?”

   proof ↗⚑ flag

Setup

1. power userFirst-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts

   weight 2 · round to Token2
   YubiKey!disputedcontradicted4/10

   Yubico ships an official 'Yubico Authenticator' app described as an 'intuitive and easy-to-use GUI interface' and provides technical guides for SSH/PGP/PIV/FIDO setup, but these are protocol-specific developer docs, not an end-to-end enrollment wizard for registering a key with personal accounts. A hands-on community report (yubikey-comm-13) describes exactly the opposite of guided onboarding: a new user enrolled keys without setting a PIN because the right guidance wasn't surfaced, then had to unenroll everywhere, set a PIN, and re-enroll — a concrete documented setup failure for a power user. Missing for 10: a dedicated first-run setup app/wizard walking users through registering with common accounts (Google, GitHub, etc.), and independent corroboration that such guidance works smoothly in practice.

   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitiv…”
   • [community] “This part can be frustrating for a novice adopting security keys. The key works out of the box without PIN. If you didn't come across the ri…”
   • [claimed-docs] “This guide shows how to generate and use SSH keys directly on your FIDO2 security key with OpenSSH.”

   proof ↗⚑ flag

   Token2~partialclaimed6/10

   Token2 provides multiple avenues for onboarding: a browser-based FIDO2/passkey demo to test registration (token2-docs-5, token2-docs-16), OS-native guidance for macOS/Linux/Chrome and Windows control panel (token2-docs-13/14/15), a companion GUI app for device/passkey management (token2-docs-1/7/8), and an FAQ entry on setting up a backup key (token2-docs-17). This gives a reasonably guided path but is scattered across docs/tools rather than a single cohesive first-time setup wizard that walks a user through registering with specific real-world accounts (e.g., Google, Microsoft, GitHub). Missing for 10: a unified step-by-step onboarding flow/app tailored to major account providers, and independent user reports confirming ease of first-time setup.

   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “Explore FIDO2 and passkey authentication hands-on. Register a security key or passkey, then log in with it — all in your browser using the W…”
   • [claimed-docs] “No special tool installation is needed to start using the FIDO keys, as most modern browsers will prompt to set a PIN when required”
   • [claimed-docs] “If you are using macOS or Linux, you can manage your FIDO2 keys using the tool integrated into the latest Chromium based browsers, such as G…”
   • [claimed-docs] “You can use the standard Windows control panel tool to manage your key, as long as you run Windows 10 build 1903 or later.”
   • [claimed-docs] “How Do I Set Up a Backup Key?”
   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

Source

1. security engineerThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device

   weight 2 · round drawn
   YubiKey—none0/10

   Yubico documentation and community evidence describe YubiKey firmware as closed and non-upgradable ('proprietary smartcard', 'not being able to flash firmware is a feature'), with no mention of open-sourcing or third-party firmware audits anywhere in the evidence pack; no vendor claim or independent report of open/audited firmware exists to evaluate.

   • [community] “YubiKey Firmware is Not Upgradable... So, Yubico is providing free replacements, right? I have a handful of these Yubikeys…”
   • [community] “Not being able to flash the firmware is a feature, not a bug :) Its the fundamental reason I won't buy NitroHSM because of the unknown-unkno…”
   • [community] “Yubico hardware [is] more compact and less bulky than anything else out there... Yubico software [has an] extensive featureset with more con…”
   • [community] “A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you like…”

   proof ↗⚑ flag

   Token2—none0/10

   All evidence concerns open-source host-side management tools (fido2-manage GUI, companion app, bulk-enrollment scripts) that run on a computer to manage the keys — none of it addresses whether the actual device firmware running on the Token2 hardware key itself is open source or has undergone independent security audit.

   ⚑ flag

Updates

1. security engineerThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

   weight 2 · round to YubiKey
   YubiKey!disputedcontradicted4/10

   Docs show only a firmware-version lookup tool (ykman/Authenticator) with no official advisory page, CVE list, or affected-model lookup in the evidence pack, and community reports confirm YubiKey firmware is not field-upgradable — vulnerability response instead relies on ad-hoc device replacement (comm-3, comm-5, comm-8) which posters describe as inconsistent and manual (comm-2, comm-4, comm-6), directly undercutting any 'clear fix pipeline' claim. missing for 10: published security-advisory index, affected-model/serial lookup tool, documented recall/replacement SLA, and any firmware-update delivery mechanism.

   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitiv…”
   • [community] “YubiKey Firmware is Not Upgradable... So, Yubico is providing free replacements, right? I have a handful of these Yubikeys…”
   • [community] “Previously when their Yubikey 4's were found to be susceptible to the ROCA vulnerability, they issued replacements for any customers who had…”
   • [community] “Not being able to flash the firmware is a feature, not a bug :) Its the fundamental reason I won't buy NitroHSM because of the unknown-unkno…”
   • [community] “I think the most annoying part of this is that you cannot just replace a YubiKey. You need to manually go through each account and replace t…”
   • [community] “Don't have high hopes for this but I just requested a replacement device through their support system as the offered mitigations are not som…”
   • [community] “They really should [issue replacements]. The recovery of the one secret the device is supposed to keep is catastrophic. Sure, the recovery i…”

   proof ↗⚑ flag

   Token2—none0/10

   Evidence covers key management tools (PIN, passkeys, PIV, SSH) but contains no security advisories, CVE/vulnerability disclosure process, affected-model lookup tool, or firmware update delivery mechanism for Token2 devices.

   ⚑ flag

Agent provisioning

1. ai-native userAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console

   weight 2 · round to YubiKey
   YubiKey~partialprobed5/10

   Yubico's YubiEnterprise 'YubiKey as a Service' REST API is documented and publicly live (console.yubico.com/apidocs/), providing a programmatic surface for fleet delivery, inventory, and shipment management that an agent could call instead of a human-only console. However, the evidence pack gives no detail on specific endpoints for ordering, assignment, or pre-registration workflows, no sample agent integration, and no independent confirmation of end-to-end automation success. Missing for 10: detailed API endpoint documentation for order/assign/pre-register flows, evidence of actual agent-driven automation, and independent corroboration of the API's completeness.

   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”

   proof ↗⚑ flag

   Token2~partialprobed3/10

   Token2 ships an open-source CLI (fido2-manage) for local device configuration and a PowerShell bulk-enrollment script that automates pre-registering keys into Microsoft Entra ID via Microsoft's Graph API — some scriptable, agent-drivable provisioning exists. However, there is no evidence of Token2's own documented enterprise API for ordering or assigning keys to users, and probes confirm no OpenAPI/swagger spec exists on their site. missing for 10: a Token2-owned ordering API, an assignment/fleet-management API, and any documented enterprise API surface beyond third-party (Microsoft) integration scripts.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Delivery

1. it adminAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics

   weight 2 · round to YubiKey
   YubiKey~partialprobed6/10

   Yubico's YubiEnterprise 'YubiKey as a Service' REST API is documented and live at console.yubico.com/apidocs/, described as the programmatic surface for fleet delivery, inventory, and shipment management — directly matching the API/console-driven distribution story. However, this rests on a single probe citation with no deeper documentation of the shipping workflow itself, no case studies, and no independent corroboration that enterprises use it this way in practice. Missing for 10: detailed docs on shipment/delivery mechanics, customer/independent confirmation of the service in use, and console UI evidence beyond the API doc existing.

   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”

   proof ↗⚑ flag

   Token2—none0/10

   Evidence covers device management, bulk enrollment, and provisioning tools but nothing about a logistics/delivery service (e.g., automated shipping of physical keys to distributed employees) driven by API or console. No fulfillment, shipping, or distribution capability is documented anywhere in the evidence pack.

   ⚑ flag

Idp

1. it adminThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

   weight 2 · round to Token2
   YubiKey—none0/10

   The evidence pack covers YubiKey's general FIDO2/WebAuthn/passkey protocol support and a fleet-management API (YubiEnterprise) for shipment/inventory, but contains no mention of specific IdP integrations (Okta, Entra ID, Google Workspace) or of admin-configurable policies enforcing hardware-key-only authentication. Since IdP integration and policy enforcement are a fair and expected axis for an enterprise MFA hardware vendor, absence of evidence means 'none' rather than 'na'. Missing for 10: documented Okta/Entra ID/Google Workspace integration guides, admin policy/enforcement console features, and any independent confirmation these integrations work in practice.

   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [claimed-docs] “the WebAuthn API enables servers to register and authenticate users using public key cryptography instead of a password”
   • [claimed-docs] “YubiKey — strongest hardware-backed passkey”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 documents a dedicated Entra ID bulk-enrollment tool leveraging the Graph API, showing concrete IdP integration for one provider, and its keys are standard FIDO2 devices that any IdP could require via WebAuthn policy. However, there is no evidence of Okta or Google Workspace-specific integration tooling, nor documentation of admin-side policy enforcement (e.g., conditional access rules mandating hardware-key auth) — these are typically the IdP's own settings, not something Token2 documents supporting or configuring. Missing for 10: Okta integration evidence, Google Workspace integration evidence, and any documentation of fleet-wide policy enforcement/reporting.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [claimed-docs] “the miniDriver is needed to configure smartcard-based certificate enrollment and login with Windows on-premises Active Directory.”

   proof ↗⚑ flag

Provisioning

1. it adminProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys

   weight 3 · round to YubiKey
   YubiKey~partialprobed6/10

   Yubico documents ykman for scriptable bulk device configuration (PIN/PIV/OATH/OTP setup) and a live YubiEnterprise 'YubiKey as a Service' REST API covering fleet delivery, inventory, and shipment management, plus PIV attestation to verify keys were hardware-generated — together these map to pre-registration, bulk config, and some lifecycle tracking. Missing for 10: detailed enterprise lifecycle-tracking dashboard docs, independent/customer case studies of at-scale deployment, and clearer documentation tying pre-registration workflows directly to the API rather than inferring from an apidocs page title.

   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [claimed-docs] “The concept of attestation is used to show that a certain asymmetric key has been generated on device and not imported.”
   • [claimed-docs] “This certificate should be used for the purpose of verifying that the key was generated in device.”
   • [claimed-docs] “Configure your YubiKey via the command line.”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 offers a PowerShell-based bulk enrollment tool for Entra ID (fido2_bulkenroll_entraid) and an open-source fido2-manage CLI/GUI for per-key PIN, biometric, and passkey configuration, which supports pre-registration and bulk configuration workflows. However, there is no evidence of an organization-wide inventory, dashboard, or lifecycle-tracking system for issued keys beyond individual device management and Entra-specific scripting. Missing for 10: centralized fleet inventory/dashboard, cross-platform (non-Entra ID) bulk provisioning, and lifecycle status tracking (issued/revoked/expired) across an organization.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

Certifications

1. it adminCertified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance)

   weight 2 · round drawn
   YubiKey—none0/10

   The evidence pack contains no mention of FIPS 140 validation, Common Criteria certification, or documented durability/water/crush resistance testing for any YubiKey model. While this axis clearly applies to a hardware security key product aimed at regulated environments, none of the docs, community, or probe items address certification status or physical durability specs, so there is nothing to credit.

   ⚑ flag

   Token2—none0/10

   The evidence pack covers management tools and software (companion apps, FIDO2 demo, PIV miniDriver) but contains no mention of FIPS 140 validation, Common Criteria certification, or physical durability specifications (water/crush resistance) for any Token2 hardware devices. missing for 10: FIPS 140 validation certificates, Common Criteria certification listings, IP rating or crush-resistance test documentation for hardware keys.

   ⚑ flag

Connectors

1. power userThe lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors

   weight 2 · round drawn
   YubiKey—none0/10

   The evidence pack contains no documentation or community confirmation of specific YubiKey form factors (USB-C, USB-A, keychain, nano) — only general docs about protocols/SDKs and community comments about size/bulkiness in vague terms (e.g., yubikey-comm-9 says 'more compact and less bulky' without specifics). Missing for 10: explicit product-line documentation of USB-A/USB-C variants, nano/keychain form factors, and any independent confirmation of the lineup breadth.

   ⚑ flag

   Token2—none0/10

   The evidence pack focuses entirely on software tools (FIDO2 management apps, TOTP toolset, PIV drivers) and never describes Token2's physical hardware lineup, connector types (USB-C/USB-A), or form factors (keychain, nano). No mention of product SKUs, dimensions, or port types is present, so there's no basis to confirm coverage of power-user form-factor variety. Missing for 10: hardware product listings, connector-type specs, form-factor descriptions (nano/keychain), any comparison chart of models.

   ⚑ flag

Nfc

1. power userTap the key on my phone over NFC to authenticate in mobile browsers and apps

   weight 2 · round to YubiKey
   YubiKey~partialclaimed6/10

   Yubico's own SDK docs confirm NFC support for both Android (yubikit-android supports USB and NFC-enabled YubiKeys) and iOS (yubikit-ios provides NFC OTP requests), and YubiKey's core FIDO2/WebAuthn/passkey stack (docs-27, docs-14, docs-16) is the basis for authenticating in mobile browsers/apps, but the evidence is SDK/developer-facing rather than an end-user confirmation that a stock mobile browser/app tap-to-auth flow just works. missing for 10: an explicit first-party or hands-on claim that end-users can tap NFC on a phone in a mobile browser (not just app SDK) to authenticate, and independent/community corroboration of real-world NFC mobile browser use.

   • [claimed-docs] “YubiKit is an Android library provided by Yubico to enable YubiKey support in Android apps. Both USB and NFC-enabled YubiKeys are supported.”
   • [claimed-docs] “The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-ena…”
   • [claimed-docs] “YubiKey — strongest hardware-backed passkey”
   • [claimed-docs] “Passkeys are the long awaited replacement for passwords.”
   • [claimed-docs] “the WebAuthn API enables servers to register and authenticate users using public key cryptography instead of a password”

   proof ↗⚑ flag

   Token2~partialclaimed4/10

   Token2's own tooling confirms its FIDO2 keys support NFC as a communication transport (used by the fido2-manage companion app to manage keys over USB or NFC), which implies NFC-capable hardware, but there is no explicit documentation stating that users can tap the key on a phone to authenticate within mobile browsers or apps via WebAuthn/CTAP2 NFC. Missing for 10: explicit end-user documentation or demo of phone-NFC-based authentication in mobile browsers/apps, and any independent confirmation of this specific mobile use case.

   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to YubiKey
   YubiKey~partialprobed6/10

   Yubico's ykman CLI is documented as functionally interchangeable with the Yubico Authenticator GUI for core device configuration (enabling applications, PINs, PIV/OATH/OTP slots, firmware info), and the YubiEnterprise REST API covers fleet-management tasks that would otherwise be done via console UI, giving real API/CLI parity for administrative workflows. However there's no evidence of a unified, fully-documented API surface covering every consumer-facing UI action (e.g., newer Authenticator app credential-management screens), and no llms.txt/MCP endpoint exists for agent discovery of these surfaces. Missing for 10: comprehensive mapping of every UI feature to an API/CLI equivalent, and agent-discoverable API documentation (llms.txt/MCP/OpenAPI all return 404).

   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.c…”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitiv…”
   • [probe] “PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (…”

   proof ↗⚑ flag

   Token2~partialprobed4/10

   Token2 ships an open-source CLI (fido2-manage) that overlaps with much of the companion GUI's functionality — resident credential/passkey management, PIN setup, biometric template management, and SSH key operations can all be scripted — giving some AI-native/automation parity with the desktop UI. However, there is no true REST/HTTP API (probes confirm openapi.json/swagger.json all 404), and several UI-only web tools (TOTP toolset, WebAuthn browser demo, factory reset) have no documented programmatic equivalent. Missing for 10: a formal API surface (REST/OpenAPI) covering all UI functions, CLI/API parity for the web-based demo and TOTP tools, and independent confirmation that CLI coverage is fully equivalent to the GUI.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “Generate and verify TOTP codes entirely in your browser. Algorithm: SHA-1. All computation happens locally — no seed is ever sent to a serve…”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://www.token2.com/openapi.json, https://www.token2.com/swagger.json, https://www.token2.com/api…”
   • [probe] “official CLI documented at https://github.com/token2/fido2-manage”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Token2
   YubiKey—none0/10

   YubiKey's core design explicitly prevents exporting the data it stores — private keys are generated on-device and 'cannot be exported or extracted' (yubikey-docs-23), and SSH/FIDO2 docs stress private keys 'never leave the hardware' (yubikey-docs-5). There is no vendor or community evidence of any open-format bulk data export/portability path; the product's security model is fundamentally opposed to this story.

   • [claimed-docs] “you can generate the private key directly on the hardware, where it cannot be exported or extracted”
   • [claimed-docs] “FIDO2 security keys, such as the YubiKey, strengthen SSH security by ensuring your private SSH keys never leave the hardware security key.”
   • [claimed-docs] “the shared secrets are stored and processed in the YubiKey's secure element”

   proof ↗⚑ flag

   Token2~partialprobed5/10

   Token2 supports exporting TOTP seeds as open CSV/JSON files for Entra ID import, and its open-source fido2-manage tool lets users list, download, and rehydrate resident credentials and SSH keys from FIDO2 devices, plus it's explicitly manufacturer-agnostic (works with any FIDO2.1 key), supporting migration away from Token2 hardware without lock-in. However, this covers only specific data types (TOTP seeds, credentials, SSH keys) rather than a full account/data export, and there's no unified 'export everything' feature or documentation. Missing for 10: comprehensive account-wide data export, first-party documentation framing this as a full data portability/exit feature, independent verification of export completeness.

   • [claimed-docs] “Export the current seed as an Entra ID hardware-token import file (CSV or JSON).”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “SSH security keys: generate, list resident, download (rehydrate), upload to a remote (`ssh-copy-id`), add to the local ssh-agent”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Token2
   YubiKey—none0/10

   YubiKey is closed hardware/firmware — community evidence explicitly notes it is 'a proprietary smartcard' and that Yubico 'does not permit firmware flashing,' with no vendor claim or evidence of the core product's source being published under an open license. Some client SDKs/CLIs (python-fido2, ykman) are open-source, but that is tooling around the product, not the product's own source.

   • [community] “A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you like…”
   • [community] “Yubico hardware [is] more compact and less bulky than anything else out there... Yubico software [has an] extensive featureset with more con…”
   • [community] “YubiKey Firmware is Not Upgradable... So, Yubico is providing free replacements, right? I have a handful of these Yubikeys…”

   proof ↗⚑ flag

   Token2~partialprobed6/10

   Token2 open-sources some companion tooling on GitHub (fido2-manage, fido2_bulkenroll_entraid) with real activity (112 stars, recent pushes), letting an AI-native user inspect that code, but the core hardware product/firmware and several web tools (TOTP toolset, FIDO2 demo) are not shown to have public source, and no explicit license file/type is cited. Missing for 10: confirmed OSI license text, source availability for the full product line (not just auxiliary management tools).

   • [claimed-docs] “Open-source cross-platform desktop companion application for managing FIDO2 security keys.”
   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round drawn
   YubiKey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Token2—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

1. ai-native userControl data retention and deletion

   weight 2 · round to Token2
   YubiKey—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Token2~partialclaimed5/10

   Token2's tools give users direct control to delete data stored on their own security keys — resident credentials/passkeys can be listed, edited, and deleted, biometric templates can be deleted, and factory resets are supported (token2-gh-1, token2-gh-3, token2-docs-7). This covers device-level data deletion but there is no documentation of server-side retention policies, account-level data deletion, or how long any cloud-side telemetry/data is retained. Missing for 10: server-side/account data retention policy documentation, explicit data-deletion request process for any cloud-stored data, independent confirmation of retention practices.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”

   proof ↗⚑ flag

2. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   YubiKey—none0/10

   The evidence pack covers YubiKey's hardware authentication, SDKs, and CLI tooling, but contains no mention of telemetry collection or any opt-out/privacy-control setting for Yubico software (ykman, Yubico Authenticator, or the YubiEnterprise console). Since companion software and cloud services could plausibly include telemetry, the axis applies, but there's no evidence of a telemetry opt-out feature.

   ⚑ flag

   Token2—none0/10

   The evidence pack contains no mention of telemetry, analytics, or usage tracking, nor any settings to opt out of such tracking, for Token2's desktop companion app, fido2-manage tool, or web tools. missing for 10: any documentation of data collection practices, a privacy policy reference, or a telemetry opt-out mechanism.

   ⚑ flag

Credential management

1. power userList and delete the passkeys stored on my key and know its credential capacity before it fills up

   weight 2 · round to Token2
   YubiKey~partialprobed4/10

   Yubico's ykman CLI/GUI (docs-4, probe-rt-1) provides broad scriptable device management (PIV/OATH/OTP slots, PINs, device info) and firmware/version info tools (docs-15/25), suggesting some credential-management capability exists, but no evidence explicitly confirms listing/deleting FIDO2 passkey credentials or showing passkey storage capacity/limits. Community threads discuss losing track of which accounts a key is enrolled in (yubikey-comm-7) rather than a management UI. Missing for 10: explicit documentation of a 'list/delete FIDO2 credentials' command, and disclosure of the discrete passkey slot capacity/limit warning.

   • [claimed-docs] “Configure your YubiKey via the command line.”
   • [probe] “PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --fr…”
   • [claimed-docs] “The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
   • [community] “I have redundant keys for backup access. But I have no idea which accounts I used the lost key for, in order to log into them one by one to …”

   proof ↗⚑ flag

   Token2~partialprobed7/10

   fido2-manage (with GUI and CLI) lists resident credentials/passkeys with user handle, allows delete and edit metadata, and works over USB/NFC for any FIDO2.1 device, directly covering list/delete of passkeys stored on the key. However, there is no explicit evidence of a feature reporting remaining credential capacity or slot count before the key fills up. Missing for 10: explicit credential-capacity/slots-remaining reporting, independent hands-on confirmation of listing/deleting behavior.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

Fido2

1. security engineerThe key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username

   weight 3 · round drawn
   YubiKey✓fullcommunity8/10

   YubiKey firmware 5+ and CTAP2 support discoverable/resident credentials for passwordless, usernameless passkey sign-in, backed by Yubico's own passkey docs, WebAuthn docs, python-fido2/java-webauthn-server SDKs, and marketing explicitly calling it 'strongest hardware-backed passkey', plus community confirmation of FIDO2/WebAuthn support alongside other smartcard apps. Missing for 10: no independent hands-on test specifically confirming resident-key/discoverable-credential storage limits or usernameless login flow success in the wild.

   • [claimed-docs] “YubiKey 5.8 is here — hardware signing, CTAP 2.3, and smoother passkey UX.”
   • [claimed-docs] “Passkeys are the long awaited replacement for passwords.”
   • [claimed-docs] “the WebAuthn API enables servers to register and authenticate users using public key cryptography instead of a password”
   • [claimed-docs] “this guide will provide all the necessary technical knowledge required to adopt passkeys into your application”
   • [claimed-docs] “YubiKey — strongest hardware-backed passkey”
   • [claimed-docs] “Provides library functionality for communicating with a FIDO device over USB as well as verifying attestation and assertion signatures.”
   • [claimed-docs] “Provides implementations of the Relying Party operations required for a server to support Web Authentication, including passkey authenticati…”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”

   proof ↗⚑ flag

   Token2✓fullprobed8/10

   Token2 sells FIDO2 hardware keys explicitly supporting resident/discoverable credentials (passkeys), with documentation and an open-source companion tool (fido2-manage) that lists, edits, and manages resident credentials including user handles, plus a browser-based demo to register and authenticate via WebAuthn without typing a username. Independent GitHub evidence corroborates the resident-key management feature set (list with user handle, delete, edit metadata). missing for 10: no explicit third-party/independent test confirming passwordless username-less sign-in flow in production RP scenarios, and no FIDO Alliance certification citation for discoverable credential compliance.

   • [github] “Resident credentials (passkeys): list (with user handle), delete, edit metadata”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag

2. power userThe key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers

   weight 2 · round to YubiKey
   YubiKey✓fullcommunity8/10

   YubiKey's core product design centers on FIDO2/WebAuthn and U2F as documented protocols, and community evidence corroborates that these keys function as WebAuthn/FIDO2 authenticators and PIV/GPG smartcards in real-world use across services. The docs describe passkey/WebAuthn support generically rather than confirming each specific service, but WebAuthn is a standard so this is a reasonable cross-service claim; independent community posts (yubikey-comm-14, yubikey-comm-16) reinforce broad protocol compatibility in practice. missing for 10: explicit named confirmation/citations for Google, GitHub, Microsoft, and specific password manager integrations rather than generic standard-protocol docs.

   • [claimed-docs] “the WebAuthn API enables servers to register and authenticate users using public key cryptography instead of a password”
   • [claimed-docs] “Passkeys are the long awaited replacement for passwords.”
   • [claimed-docs] “YubiKey — strongest hardware-backed passkey”
   • [community] “So far, Yubikeys are the only ones I've found that support both FIDO2/WebAuthn as well as GPG smart card functionality for use with pass(1).…”
   • [community] “Also, yubikey works as a PIV smartcard.”
   • [claimed-docs] “FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN …”

   proof ↗⚑ flag

   Token2~partialclaimed6/10

   Token2 provides standards-based FIDO2/WebAuthn/U2F hardware keys with strong first-party tooling for Microsoft Entra ID enrollment and a general WebAuthn demo/testing tool, implying broad cross-service compatibility as a certified FIDO2.1 device. However, there is no direct documentation or independent confirmation of successful registration/use with Google, GitHub, or specific password managers. Missing for 10: explicit vendor or third-party evidence of working as a 2FA/passkey with Google, GitHub, and named password managers.

   • [claimed-docs] “This tool streamlines the process of registering FIDO2 security keys in Microsoft Entra ID by leveraging the FIDO2 Provisioning Graph API.”
   • [claimed-docs] “Register a security key or passkey, then log in with it — all in your browser using the WebAuthn API.”
   • [claimed-docs] “This manufacturer-agnostic tool works with any FIDO2.1 device.”
   • [claimed-docs] “Explore FIDO2 and passkey authentication hands-on. Register a security key or passkey, then log in with it — all in your browser using the W…”
   • [github] “fido2-manage is a tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management”

   proof ↗⚑ flag

User verification

1. security engineerThe key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate

   weight 2 · round drawn
   YubiKey✓fullcommunity8/10

   Docs explicitly confirm FIDO2 supports optional PIN-based user verification in addition to touch/presence (yubikey-docs-6), and community evidence corroborates PIN enrollment is a real, if sometimes overlooked, setup step (yubikey-comm-13). This directly matches on-device verification (PIN) preventing a stolen key alone from authenticating; biometric variants exist on Bio series keys but aren't explicitly documented here. Missing for 10: explicit mention of built-in biometric/fingerprint verification and independent hands-on confirmation of PIN enforcement blocking a stolen key.

   • [claimed-docs] “FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN …”
   • [community] “This part can be frustrating for a novice adopting security keys. The key works out of the box without PIN. If you didn't come across the ri…”

   proof ↗⚑ flag

   Token2✓fullprobed8/10

   Evidence confirms FIDO2 PIN setup/change and biometric template enrollment/management via the companion tool and fido2-manage (PIN management, min PIN length, biometric templates: list, rename, delete, enroll), and browsers/OS natively prompt for PIN when required, satisfying on-device user verification against theft. missing for 10: no independent/hands-on third-party testing confirming UV enforcement during actual authentication ceremonies, and no explicit CTAP2 'uv' flag/attestation documentation.

   • [github] “PIN management: set, change, set minimum PIN length, min-PIN-length RP allow-list... Biometric templates (bio models): list, rename, delete,…”
   • [claimed-docs] “It provides a simple interface to view device information, manage passkeys, change PINs, and perform factory resets.”
   • [claimed-docs] “No special tool installation is needed to start using the FIDO keys, as most modern browsers will prompt to set a PIN when required”
   • [claimed-docs] “fido2-manage is an open-source tool allowing to manage FIDO2.1 devices over USB or NFC, including Passkey (resident keys) management. It als…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Token2's open-source fido2-manage — 'An open-source FIDO2.1 key management tool (with a GUI) under diff…”

   proof ↗⚑ flag