If this is your first passkey, then you will need to use a mobile device, hardware security key or password manager


    Make sure Bluetooth is enabled on your mobile device (and your computer if you are on a laptop or desktop) before beginning the passkey registration process

    1. Enter your Berkeley Lab Identity account user name and password then click login


    2. Enter your One-Time Password using Google Authenticator or Yubikey.



    3. Click Create Passkey



    4. Choose iPhone, iPad or Android device and click Next



    5. Scan the QR code with your phone's camera app and create the passkey on your mobile device



    6. Follow the steps below on your mobile device to register a passkey, based on the platform you use:

      • Apple ID – Use iCloud Keychain on your Apple device

      • Google Password Manager – Use your Google account on Android or Chrome

      • 1Password – Use the 1Password app installed on your device

      Select the appropriate option for your platform and complete the on-screen prompts to finish passkey registration.

    7. Create a nickname for your Passkey Key on the browser.
      (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)



    8. Key created successfully!

    9. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys

    10. Browse to an LBL service (eg lets.lbl.gov) to confirm that you can log in via a passkey

    Make sure you have the newer, FIDO2-supported Yubikey:. You will get a "Failed to create passkey: This security key cannot be registered here because it only supports legacy U2F. Use a FIDO authenticator that supports passkeys and user verification (PIN or biometric), or choose another passkey provider on this device" error if your U2F device is compatible if your Yubikey does not support FIDO2.

    1. Enter your Berkeley Lab Identity account user name and password then click login



    2. Enter your One-Time Password using Google Authenticator or Yubikey



    3. Click Create Passkey



    4. Choose Security key and click Next



    5. Insert your (FIDO2-supported) Yubikey, if not already plugged in, and Touch/Tap the Yubikey



    6. Create a PIN, if one has not already been created
      Note: Create a PIN that is at least 6 characters long. For increased security, avoid easily guessed PINs (for example, birthdays or "123456"). Instead, create a strong PIN using a combination of numbers, letters, and symbols.

    7. Touch the Yubikey to verify

    8. Create a nickname for your Key
      (Note: include the type of device (eg Chrome, Apple, 1Password, Yubikey, etc) in the name you enter to better distinguish between your multiple passkeys)



    9. Register another passkey (click Create Passkey) using a different platform if you do not already have 2 or more passkeys.

    10. Browse to an LBL service (eg lets.lbl.gov) to confirm that you can log in via a passkey



    • No labels