If this is your first passkey, then you will need to use a mobile device, hardware security key or password manager

The Firefox built-in Password Manager cannot store or manage passkeys. To use passkeys in Firefox, you must use a hardware security key (e.g., YubiKey) or a compatible third-party browser extension (e.g., 1Password). Do not confuse "Device Sign-in" (which unlocks your password list) with Passkey authentication.

Make sure Bluetooth is enabled on your mobile device (and your computer if you are on a laptop or desktop) before beginning the passkey registration process


  1. Enter your Berkeley Lab Identity account user name and password then click login


  2. Enter your One-Time Password using Google Authenticator or Yubikey.



  3. Click Create Passkey



  4. Scan the following QR code using your Mobile Device and click create Passkey on your Mobile screen.

     

  5. Allow Bluetooth on your mobile device.



  6. Follow the steps below on your mobile device to register a passkey, based on the platform you use:

    • Apple ID – Use iCloud Keychain on your Apple device

    • Google Password Manager – Use your Google account on Android or Chrome

    • 1Password – Use the 1Password app installed on your device

    Select the appropriate option for your platform and complete the on-screen prompts to finish passkey registration.

  7. Create a nickname for your Passkey Key on the browser.
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)


  8. Key created successfully!

  9. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys
  10. Browse to an LBL service (gmail.lbl.gov, lets.lbl.gov, etc) to confirm that you can log in via a passkey

Make sure you have the newer, FIDO2-supported Yubikey:. You will get a "Failed to create passkey: This security key cannot be registered here because it only supports legacy U2F. Use a FIDO authenticator that supports passkeys and user verification (PIN or biometric), or choose another passkey provider on this device" error if your U2F device is compatible if your Yubikey does not support FIDO2.


If the passkey registered on your Yubikey is not working in Firefox, then you may need change the security.webauth.webauthn_enable_softtoken advanced setting to false by browsing to about:config

  1. Enter your Berkeley Lab Identity account user name and password then click login


  2. Enter your One-Time Password using Google Authenticator or Yubikey.



  3. Click Create Passkey



  4. Insert your (FIDO2-supported) Yubikey, if not already plugged in, and Touch/Tap the Yubikey



  5. Create a PIN
    Note: Create a PIN that is at least 6 characters long. For increased security, avoid easily guessed PINs (for example, birthdays or "123456"). Instead, create a strong PIN using a combination of numbers, letters, and symbols.



  6. Touch the Yubikey to verify



  7. Create a nickname for your Key
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)



  8. The passkey key is successfully registered, so you can now use it as a passkey for your second factor!



  9. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys
  10. Browse to an LBL service (gmail.lbl.gov, lets.lbl.gov, etc) to confirm that you can log in via a passkey
  1. Enter your Berkeley Lab Identity account user name and password then click login

  2. Enter your One-Time Password using Google Authenticator or Yubikey.

  3. Click Create Passkey


  4. Unlock 1Password.



  5. Click save on the 1Password.



  6. Create a nickname for your Passkey Key on the browser.
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)


  7. Key created successfully!
  8. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys
  9. Browse to an LBL service (gmail.lbl.gov, lets.lbl.gov, etc) to confirm that you can log in via a passkey


Make sure you are logged into the .

  1. Login to  page

  2. On the manage passkey page, Enter the name of the Passkey you would like to create and click "Create Passkey"



  3. Click “Save another way”



  4. Select “iCloud Keychain.”



  5. Use Touch ID to proceed



  6. Create a nickname for your Passkey Key
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)



  7. Key created successfully



  8. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys
  9. Browse to an LBL service (gmail.lbl.gov, lets.lbl.gov, etc) to confirm that you can log in via a passkey

Make sure Offer to save passwords and passkeys is turned On under More > Passwords and autofill > Google Password Manager > Settings per https://support.google.com/accounts/answer/6197437


  1. Login to  page

  2. On the manage passkey page, Enter the name of the Passkey you would like to create and click "Create Passkey"



  3. Click “Save another way” to create a passkey on your YubiKey




  4. Select “Google Password Manager.”



  5. Click continue to save your Security Key on Google Password Manager



  6. Confirm the username and click “Create”



  7. Create a PIN
    Note: Create a PIN that is at least 6 characters long. For increased security, avoid easily guessed PINs (for example, birthdays or "123456"). Instead, create a strong PIN using a combination of numbers, letters, and symbols.



  8. Create a nickname for your Key
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)



  9. The Passkey Key is successfully registered. 



  10. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys
  11. Browse to an LBL service (gmail.lbl.gov, lets.lbl.gov, etc) to confirm that you can log in via a passkey

  1. Login to page

  2. On the manage passkey page, Enter the name of the Passkey you would like to create and click "Create Passkey"




  3. Create a nickname for your Key and click "Create Passkey"
    (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)

  4. Make sure you select work profile on this screen.



  5. If you already have Passkey saved in Google Password manager it will ask for the 6 digit PIN when you created the passkey.


  6. The passkey key is successfully registered, so you can now use it as a passkey for your second factor!