A hardware token (sometimes called a "security key") is a small physical device used to provide an extra layer of security when logging in to your accounts. It’s part of a method called two-factor authentication (2FA) or multi-factor authentication (MFA).
Instead of just entering a password, you also use this device to prove your identity.
Important: CGI does not provide hardware tokens. If you choose to use a hardware token, you are responsible for purchasing a token that will work with Duo Mobile at your own expense.
What CGI can do:
- advise on the requirements needed for a hardware token, so you purchase one that will work with Duo
- provide basic troubleshooting
Requirements for a Hardware Token that Works with Duo Mobile
If you're buying a hardware token to use with Duo, make sure it meets one of the following:
-
For Tap-to-Authenticate (Online Use Only):
- Look for a FIDO2 or U2F security key (like a YubiKey Security Key NFC).
- Works by tapping the key during login—no codes needed.
- Does not work offline or generate passcodes.
-
For Backup Codes (Offline or Code-Based Use):
- Look for an OTP (One-Time Passcode) token or a YubiKey 5 Series.
- These generate 6-digit codes for Duo logins.
- Required if you need offline access or code entry fallback.
✅ Tip: Duo only supports tokens that are HOTP-compatible (not TOTP), so avoid buying generic code generators unless you're sure they say “OATH HOTP.”
Amazon sells many different types of hardware tokens. Here are two popular ones that can work with Duo. How well they work depends on what you want to use them for.
Be sure to consult Duo's user guide for more detailed information on hardware tokens.
| Feature | Security Key NFC (Budget) | YubiKey 5 Series (Premium) |
|---|---|---|
| FIDO2 / WebAuthn / U2F (tap-to-authenticate) | ✅ Supported | ✅ Supported |
| Yubico OTP (YubiKey-specific OTP) | ❌ Not supported | ✅ Supported |
| OATH-HOTP (standard code generation for Duo) | ❌ Not supported | ✅ Supported |
| OATH-TOTP (time-based OTP) | ❌ Not supported | ✅ Supported |
| Offline code generation (backup passcodes) | ❌ No | ✅ Yes |
| Importable into Duo as hardware token | ❌ No | ✅ Yes (OTP/HOTP) |
| Price | ~$25–30 | ~$50–60 |
Note: Be sure to check the type of USB connector carefully to ensure the token you choose is compatible with your device.
What This Means for Duo Users
The Security Key NFC is a good choice only if your Duo use is entirely web-based, online, and your organization has WebAuthn/FIDO2 enabled. It requires an active internet connection to contact Duo’s servers and complete authentication. It will not work during a power outage or other situation where there is no Wi-Fi (like when your device is in airplane mode).
If there's any chance you’ll need offline access, backup passcodes, or compatibility with older Duo experiences (like classic prompts), you’ll need the YubiKey 5 Series.