Skip to content
ProductArena

How YubiKey’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score18/100

Agent-ready 33.6 × 0.30 = 10.08

API quality 0.0 × 0.20 = 0.00

Openness 7.2 × 0.20 = 1.44

Built-in AI n/a — excluded, its ×0.15 weight renormalized away

Automation 24.0 × 0.15 = 3.60

(10.08 + 0.00 + 1.44 + 3.60) ÷ (0.30 + 0.20 + 0.20 + 0.15) = 15.12 ÷ 0.85 = 17.8 — weights renormalized over the scored components

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready33.6/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://docs.yubico.com/llms.txt“PROBE llms.txt: HTTP 404 at https://docs.yubico.com/llms.txt”
  • [probe] https://docs.yubico.com/.md“PROBE docs-md: HTTP 404 at https://docs.yubico.com/.md”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [claimed-docs] https://developers.yubico.com/yubikey-manager/“Configure your YubiKey via the command line.”
  • [claimed-docs] https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html“FIDO2 also requires user presence (a touch on your YubiKey) for cryptographic operations, and can optionally enforce user verification (PIN entry).”
  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [probe] https://developers.yubico.com/python-fido2/“PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager 5.9.2 — the building blocks for integrating and automating the key from code.”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Connect an agent via an official MCP serverweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Use an official CLIweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://developers.yubico.com/yubikey-manager/“Configure your YubiKey via the command line.”
  • [probe] https://developers.yubico.com/yubikey-manager/“official CLI documented at https://developers.yubico.com/yubikey-manager/”
  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Drive the product through a documented public APIweight 3

3 (weight) × 5 (quality) × 0.6 (partial) = 9.0 of 30 max

  • [claimed-docs] https://developers.yubico.com/yubikey-manager/“Configure your YubiKey via the command line.”
  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [probe] https://developers.yubico.com/python-fido2/“PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager 5.9.2 — the building blocks for integrating and automating the key from code.”
  • [claimed-docs] https://developers.yubico.com/PIV/“It enables RSA or ECC sign/encrypt operations using a private key stored on a smartcard (such as the YubiKey), through common interfaces like PKCS#11.”
  • [claimed-docs] https://docs.yubico.com/yesdk/“The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
  • [probe] https://docs.yubico.com/openapi.json“PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/api/openapi.json, https://docs.yubico.com/.well-known/openapi.json)”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Issue scoped/least-privilege API credentials for an agentweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Build against official SDKsweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

  • [claimed-docs] https://developers.yubico.com/python-fido2/“Provides library functionality for communicating with a FIDO device over USB as well as verifying attestation and assertion signatures.”
  • [claimed-docs] https://docs.yubico.com/yesdk/“The SDK allows you to integrate the YubiKey and its applications into your .NET-based application or library.”
  • [claimed-docs] https://developers.yubico.com/yubikit-android/“YubiKit is an Android library provided by Yubico to enable YubiKey support in Android apps. Both USB and NFC-enabled YubiKeys are supported.”
  • [claimed-docs] https://developers.yubico.com/yubikit-ios/“The library supports NFC-enabled YubiKeys and provides the APIs to request an OTP (Yubico OTP or HOTP) from the NFC YubiKeys using a NFC-enabled iOS device.”
  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://developers.yubico.com/python-fido2/“PROBE runtime (recorded 2026-09-15): Yubico's python-fido2 SDK resolves on the public PyPI registry (fido2 2.2.1), alongside yubikey-manager 5.9.2 — the building blocks for integrating and automating the key from code.”
  • [claimed-docs] https://developers.yubico.com/java-webauthn-server/“Provides implementations of the Relying Party operations required for a server to support Web Authentication, including passkey authentication.”

Subscribe to events via webhooksweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Agent-ready = 37.0 ÷ 110 × 100 = 33.6

API quality0.0/100×0.20 of the PA blend

The programmable surface once an agent is there — machine-readable spec, interactive docs, sandbox, versioning discipline.

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://docs.yubico.com/openapi.json“PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/api/openapi.json, https://docs.yubico.com/.well-known/openapi.json)”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [probe] https://docs.yubico.com/openapi.json“PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/api/openapi.json, https://docs.yubico.com/.well-known/openapi.json)”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”

Test against a sandbox environment without touching production dataweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-overview.html“The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
  • [claimed-docs] https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-overview.html“The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitive and easy-to-use (GUI) interface or ykman”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [probe] https://docs.yubico.com/openapi.json“PROBE openapi: all candidate paths 404 (https://docs.yubico.com/openapi.json, https://docs.yubico.com/swagger.json, https://docs.yubico.com/api/openapi.json, https://docs.yubico.com/.well-known/openapi.json)”

API quality = 0.0 ÷ 60 × 100 = 0.0

Openness7.2/100×0.20 of the PA blend

Can you leave, inspect, or self-host — data export, open source, portability.

Do everything through the API that I can do in the UIweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [claimed-docs] https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-overview.html“The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator ... or ykman”
  • [claimed-docs] https://docs.yubico.com/hardware/yubikey/yk-tech-manual/yk5-firmware-overview.html“The quickest and most convenient way to determine your device's firmware version is to use either the Yubico Authenticator with its intuitive and easy-to-use (GUI) interface or ykman”
  • [probe] https://docs.yubico.com/“PROBE runtime negative (recorded 2026-09-15): Yubico publishes no llms.txt on any host — https://docs.yubico.com/llms.txt answers HTTP 404 (developers.yubico.com and www.yubico.com 404 as well), and appending .md to developers.yubico.com pages answers HTTP 300 'Multiple Choices', not markdown. Docs are human-oriented HTML only; no MCP endpoint exists (mcp.yubico.com does not resolve).”

Export all of my data in open formats and leaveweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

  • [claimed-docs] https://developers.yubico.com/SSH/“you can generate the private key directly on the hardware, where it cannot be exported or extracted”
  • [claimed-docs] https://developers.yubico.com/SSH/Securing_SSH_with_FIDO2.html“FIDO2 security keys, such as the YubiKey, strengthen SSH security by ensuring your private SSH keys never leave the hardware security key.”
  • [claimed-docs] https://developers.yubico.com/OATH/“the shared secrets are stored and processed in the YubiKey's secure element”

Read the product's source under an open licenseweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [community] https://hn.algolia.com/api/v1/items/35091768“A Yubikey is just a proprietary smartcard with a bunch of apps installed and some HID emulation (pretending to be a keyboard, which you likely do not want).”
  • [community] https://news.ycombinator.com/item?id=41434500“Yubico hardware [is] more compact and less bulky than anything else out there... Yubico software [has an] extensive featureset with more controllability than most other products out there. Also Yubico is one of the few that does not permit firmware flashing.”
  • [community] https://news.ycombinator.com/item?id=41434500“YubiKey Firmware is Not Upgradable... So, Yubico is providing free replacements, right? I have a handful of these Yubikeys…”

Self-host the core productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Openness = 7.2 ÷ 100 × 100 = 7.2

Built-in AIn/a×0.15 of the PA blend

Inside-out: how agentic the product itself is for its users — built-in assistants, autonomous features.

Get AI-generated insights and suggestions from my data inside the productweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Set up automations that run autonomously in the backgroundweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Delegate tasks to a built-in AI assistant inside the productweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Operate the product with natural-language commandsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

every cell n/a — unscored (not zero), excluded from the blend

Automation24.0/100×0.15 of the PA blend

Depth of automation primitives — rules, scheduling, bulk operations, webhooks.

Perform bulk operations across many items at onceweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [probe] https://developers.yubico.com/yubikey-manager/“PROBE runtime (recorded 2026-09-15): Yubico's official ykman CLI installs keylessly from public registries and identifies itself — `uvx --from yubikey-manager ykman --version` → 'YubiKey Manager (ykman) version: 5.9.2'; Homebrew packages it as ykman ('Tool for managing your YubiKey configuration'). Full scriptable device management: enable applications, PINs, PIV/OATH/OTP slots, device info.”
  • [probe] https://console.yubico.com/apidocs/“PROBE runtime (recorded 2026-09-15): the YubiEnterprise 'YubiKey as a Service' REST API documentation is live and public at console.yubico.com/apidocs/ (page title verified keylessly) — the documented programmatic surface for fleet delivery, inventory, and shipment management.”
  • [claimed-docs] https://developers.yubico.com/yubikey-manager/“Configure your YubiKey via the command line.”

Define rules that trigger actions automatically on eventsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Schedule recurring jobs or workflowsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Automation = 4.8 ÷ 20 × 100 = 24.0