Skip to content
ProductArena

Hardware Security Keys Arena

Hardware Security Keys arenaBuyer checklist

Every requirement we judge hardware security keys products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.

54 requirements · 12 themes · verdicts for 6 products · updated 2026-09-15 · priorities mirror the story weights our scoring uses (methodology)

Procurement report →
Show the markdown export
# Hardware Security Keys — buyer checklist (RFP)

Derived from ProductArena's evidence-graded user-story taxonomy for Hardware Security Keys: 54 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have).

## Agenticness

- [ ] **[must-have]** Plug MCP servers into this product so it can use their tools
- [ ] **[must-have]** Connect an agent via an official MCP server
- [ ] **[must-have]** Drive the product through a documented public API
- [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product
- [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs
- [ ] **[should-have]** Run the product headlessly / in CI for automation
- [ ] **[should-have]** Use an official CLI
- [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent
- [ ] **[should-have]** Build against official SDKs
- [ ] **[should-have]** Subscribe to events via webhooks
- [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product
- [ ] **[should-have]** Set up automations that run autonomously in the background
- [ ] **[should-have]** Operate the product with natural-language commands
- [ ] **[should-have]** Explore an interactive API reference with runnable examples
- [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent)
- [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy
- [ ] **[nice-to-have]** Test against a sandbox environment without touching production data

## Automation depth

- [ ] **[must-have]** Define rules that trigger actions automatically on events
- [ ] **[should-have]** Perform bulk operations across many items at once
- [ ] **[should-have]** Schedule recurring jobs or workflows
- [ ] **[nice-to-have]** Version, review, and roll back my automations

## Beyond fido

- [ ] **[should-have]** Keep OpenPGP keys on the device and use them for git commit signing and encrypted email
- [ ] **[should-have]** The key covers legacy one-time-password schemes — TOTP/HOTP slots or challenge-response — for services that still lack WebAuthn
- [ ] **[should-have]** The key acts as a PIV smart card for certificate-based login — workstation sign-in, VPN, and code signing with keys that never leave the device
- [ ] **[should-have]** My SSH keys can be hardware-backed on the device — via FIDO2 sk-ssh keys, PIV, or OpenPGP — so server access requires a physical touch

## Developer tooling

- [ ] **[must-have]** Configure and manage the key from an official CLI — enable applications, set PINs, manage slots, read device state — scriptably
- [ ] **[should-have]** An agent can read a key's state programmatically — serial, firmware version, enabled applications, stored credentials — to audit security posture across a fleet
- [ ] **[should-have]** Verify device attestation at registration to enforce that only genuine, approved key models are enrolled
- [ ] **[should-have]** Official SDKs let me integrate the key into my own desktop and mobile apps

## Ecosystem compat

- [ ] **[should-have]** The key works across my operating systems and browsers, with a published compatibility catalog of supported services
- [ ] **[nice-to-have]** Require a physical key touch as the human-approval step for sensitive automated or agent-initiated actions

## Enrollment recovery

- [ ] **[must-have]** The vendor documents a credible lockout-recovery strategy — registering a backup key, and what is and is not recoverable if a key is lost
- [ ] **[should-have]** First-time setup is guided — clear instructions or a setup app walk me through registering the key with my accounts

## Firmware openness

- [ ] **[should-have]** The firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device
- [ ] **[should-have]** The vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

## Fleet management

- [ ] **[must-have]** Provision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys
- [ ] **[should-have]** An agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console
- [ ] **[should-have]** An enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics
- [ ] **[should-have]** The key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

## Form factors

- [ ] **[should-have]** Certified models exist for regulated environments — FIPS 140 validated or Common Criteria certified — with documented durability (water/crush resistance)
- [ ] **[should-have]** The lineup covers my ports and carry style — USB-C and USB-A models, keychain and low-profile nano form factors
- [ ] **[should-have]** Tap the key on my phone over NFC to authenticate in mobile browsers and apps

## Openness

- [ ] **[must-have]** Export all of my data in open formats and leave
- [ ] **[must-have]** Self-host the core product
- [ ] **[should-have]** Do everything through the API that I can do in the UI
- [ ] **[should-have]** Read the product's source under an open license

## Privacy posture

- [ ] **[must-have]** Prevent my data from being used to train AI models
- [ ] **[should-have]** Choose where my data is stored (region/residency)
- [ ] **[should-have]** Control data retention and deletion
- [ ] **[should-have]** Opt out of telemetry and usage tracking

## Protocol coverage

- [ ] **[must-have]** The key stores discoverable FIDO2 credentials (resident keys / device-bound passkeys) so users can sign in to WebAuthn services without typing a username
- [ ] **[should-have]** List and delete the passkeys stored on my key and know its credential capacity before it fills up
- [ ] **[should-have]** The key works as a WebAuthn/U2F second factor across the major services I already use — Google, GitHub, Microsoft, password managers
- [ ] **[should-have]** The key supports on-device user verification — a FIDO2 PIN or built-in biometric — so a stolen key alone cannot authenticate

---

Source: https://ultrametric.ai/productarena/arena/security-keys (evidence-graded verdicts for 6 products) · methodology: https://ultrametric.ai/productarena/methodology

Chips show the top 5 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.

Agenticness — how well agents can access and operate the productAgenticness· 17 items

How well agents can access and operate the product

Automation depth — how much of the product can run unattendedAutomation depth· 4 items

How much of the product can run unattended

Beyond fido — what the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSHBeyond fido· 4 items

What the key does beyond FIDO — PIV smart card, OpenPGP, OTP slots, hardware-backed SSH

Developer tooling — building with and managing the key — CLIs, SDKs, attestationDeveloper tooling· 4 items

Building with and managing the key — CLIs, SDKs, attestation

Ecosystem compat — where the key works — platforms, browsers, service compatibility catalogsEcosystem compat· 2 items

Where the key works — platforms, browsers, service compatibility catalogs

Enrollment recovery — getting keys enrolled and surviving loss — setup flows, backup keys, lockout recoveryEnrollment recovery· 2 items

Getting keys enrolled and surviving loss — setup flows, backup keys, lockout recovery

Firmware openness — what runs on the device — open-source firmware, update policy, vulnerability responseFirmware openness· 2 items

What runs on the device — open-source firmware, update policy, vulnerability response

  • security engineerThe firmware is open source or independently audited, so I don't have to take the vendor's word for what runs on the device

    Important, not disqualifying — weighs 2× in arena scoring · 1 of 6 products fully deliver this today

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    should-have

  • security engineerThe vendor has a clear firmware update and vulnerability-response story — advisories, affected-model lookup, and how fixes reach devices

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    should-have

Fleet management — keys at organization scale — bulk provisioning, delivery services, IdP policiesFleet management· 4 items

Keys at organization scale — bulk provisioning, delivery services, IdP policies

  • it adminProvision keys across an organization at scale — pre-registration, bulk configuration, and lifecycle tracking of issued keys

    Core requirement — weighs 3× in arena scoring · no product fully delivers this yet

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    must-have

  • ai-native userAn agent can drive key provisioning end to end — ordering, assignment, pre-registration — through documented enterprise APIs instead of a human-only console

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    should-have

  • it adminAn enterprise delivery service ships keys directly to distributed employees, driven by an API or console rather than manual logistics

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    should-have

  • it adminThe key integrates with my identity provider — Okta, Entra ID, Google Workspace — and I can enforce policies requiring hardware-key authentication

    Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet

    YubiKey logoYubiKeyNitrokey logoNitrokeyToken2 logoToken2SoloKeys Solo 2 logoSoloKeys Solo 2Feitian FIDO Keys logoFeitian FIDO Keys
    should-have

Form factors — the physical lineup — NFC, USB-C/A, biometrics, certified and hardened modelsForm factors· 3 items

The physical lineup — NFC, USB-C/A, biometrics, certified and hardened models

Openness — open source, data portability, and self-hosting storiesOpenness· 4 items

Open source, data portability, and self-hosting stories

Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items

Data-handling and privacy stories

Protocol coverage — FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential managementProtocol coverage· 4 items

FIDO2/WebAuthn depth — resident-key passkeys, user verification, credential management

Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.