--- schema_version: "1" id: 44d7b3ad9d883114c1c6d2824645b83ab6ed51d9dd71d4ccfb77a362e2f3a78a title: Security Keys (Passkeys) for MFA collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/mfa_supported_verification_methods_securitykey.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_securitykey.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 4ac85712cc292732e457c250a70593d17c806bee9451e8bba7f41b764dca5115 description: Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users. products: - Security release: "264" --- # Security Keys (Passkeys) for MFA Security keys are physical passkeys. They're small, USB or NFC devices that are easy to use for multi-factor authentication (MFA) logins because there's nothing to install and no codes to enter. This type of method is a great option if users don't have a mobile device or if phones aren't allowed where your users work (such as a PCI-compliant service center). Security keys require a supported browser to act as an intermediary between the key and your Salesforce product. Popular security keys include the YubiKey from Yubico and the Titan Security Key from Google. Security keys satisfy the phishing-resistant MFA requirement for privileged users. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important Salesforce enforces MFA requirements in the summer of 2026. See these articles for more information and detailed rollout timelines. - [Prepare for MFA Enforcement for All Employee Users](https://help.salesforce.com/s/articleView?id=005321561&type=1&language=en_US). - [Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins](https://help.salesforce.com/s/articleView?id=005321563&type=1&language=en_US). Security keys make MFA logins fast and simple. After entering their username and password, a user is prompted to connect the security key to their computer via a port or wirelessly. Then they press the button on the key to confirm their identity, and they're logged in. Security keys aren't biometric devices, even though some have a button that requires the user's touch to activate the device. After the user inserts and activates the security key, it generates the required credentials, and the browser passes them on to Salesforce to complete the login. Security keys are easy to deploy and work well in environments where mobile devices aren't an option. Users can use the same security key with multiple service providers and multiple Salesforce orgs and accounts. If you're allowing the use of security keys, plan to procure and distribute them to your users. It's also a good idea to stock some extra keys so you have a reserve inventory. Alternatively, users can self-provision their own security keys. These devices don't require up-front registration by IT or admins. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_important.png) Important As a security best practice, require users to use phishing-resistant verification methods: [Built-In Authenticators (Passkeys) for MFA](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods_bia.htm&release=264.0.0&type=5 "When employee users log in and register for multi-factor authentication (MFA), passkeys are the default option. Identify and resolve issues with passkey prompts, setup, login, and more.") or physical security keys. For more information about the security benefits of these methods, see the [WebAuthn guide](https://webauthn.guide/). ## Requirements and Considerations Security keys are supported in all Salesforce products. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note At this time, Salesforce orgs that use domains other than salesforce.com and force.com don't support U2F security keys. We're working to resolve this issue. - To support the [phishing-resistant MFA requirement](https://help.salesforce.com/s/articleView?id=xcloud.mfa_phishing_resistant.htm&release=264.0.0&type=5 "Salesforce requires multi-factor authentication (MFA) for all employee logins to Salesforce products. For internal user accounts that have a higher level of access, such as admin accounts, Salesforce requires extra security: users must complete MFA using a phishing-resistant method, such as a passkey or security key. This requirement applies to direct and single sign-on (SSO) logins for active production and sandbox orgs."), security keys are automatically enabled as a verification method for users with privileged access. You can't disable security keys for these users. - For non-privileged users, a Salesforce admin must enable the use of security keys before this option is available to users. See [Enable Security Keys for Identity Verification in Salesforce Orgs](https://help.salesforce.com/s/articleView?id=xcloud.security_u2f_enable.htm&release=264.0.0&type=5 "Security keys are small physical devices, such as YubiKeys or Titan keys, that users can use to set up passkeys for secure multi-factor authentication (MFA). With MFA enforcement, Salesforce automatically enables security keys as an available verification method for all employee users. When MFA is enforced in your org, you can't turn off this setting. If MFA isn't enforced yet in your org, turn on security keys to test them. Security keys satisfy the phishing-resistant MFA requirement for users with privileged permissions. Users can also use security keys to complete other identity verification challenges, such as device activation."). - You can use any USB-A, USB-C, Lightning, or NFC security key that's compatible with the WebAuthn (FIDO2) or FIDO Universal Second Factor (U2F) standards. Security keys can look similar to other USB authentication devices that users carry on a keychain. Look for the FIDO logo indicating that the device is compatible with the WebAuthn or U2F standards. If you're not sure, verify with your security hardware vendor that their keys are WebAuthn- or U2F-compliant. - Security keys require a supported browser. - For WebAuthn-compliant keys: Chrome, Edge Chromium, Firefox, or Safari - For U2F-compliant keys: Chrome (version 41 or later) or Edge Chromium - NFC devices aren't supported in products built on the Salesforce Platform. - Data Loader OAuth logins don't support the use of security keys. - For products built on the Salesforce Platform: If a user registered a U2F key before Summer '22, the registration is encrypted with a master encryption key accessible on the Certificate and Key Management page in Setup. Be careful when handling this master encryption key. If it's deleted, the user isn't able to log in with their U2F key. When you use the key for the first time after Summer '22, it updates to become WebAuthn-compatible. After the update, this warning no longer applies. Read about how to back up and manage master encryption key material in [Manage Master Encryption Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_using_master.htm&release=264.0.0&type=5 "Encrypted custom fields, such as Social Security Number or Credit Card Number, are encrypted with a master encryption key. This key is automatically assigned when you select fields to encrypt. You manage your own master key according to your organization’s security and regulatory needs.") ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-security-264-0-0-production-enus/8cecd769-ab2d-4e07-addf-c4f2927925e1/images/icon_note.png) Note Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations. ## Behind the Scenes The WebAuthn and U2F standards use strong public-key cryptography to protect users from man-in-the-middle attacks and malware. To learn more about what's happening behind the scenes with security keys, check out the [WebAuthn Guide](https://webauthn.guide/) or the [FIDO U2F site](https://www.yubico.com/authentication-standards/fido-u2f/). #### See Also - [Register a Security Key as an Identity Verification Method](https://help.salesforce.com/s/articleView?id=xcloud.security_u2f_register_security_key.htm&type=5&language=en_US) - [MFA Verification Methods for Direct Salesforce Login](https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&release=264.0.0&type=5 "The multi-factor authentication (MFA) login process requires users to provide an identity verification method in addition to their username and password. Salesforce MFA functionality supports several types of verification methods, including passkeys (built-in authenticators and security keys) and authenticator apps. You can control which methods are available to your users.")