Hardware security keys for a homelab: YubiKey 5 vs FIDO2-only

A security key gives your admin accounts a button you can actually put your finger on. Choose the Yubico Security Key C NFC for FIDO-backed SSH, Proxmox and supported browser logins. Choose the YubiKey 5C NFC when you also need PIV, OpenPGP or authenticator codes. The useful upgrade for everyone is a second key, enrolled and ready—not an unopened spare in a drawer.

Specifications and setup steps from Yubico, OpenSSH, Proxmox and Bitwarden documentation, checked October 26, 2026.

Quick picks: buy for the login, then the socket

• Default for USB-C: Yubico Security Key C NFC. FIDO2/WebAuthn and U2F cover the browser jobs here, and FIDO support also powers OpenSSH’s ed25519-sk keys.
• For USB-A: Yubico Security Key NFC. The same FIDO-only approach with a full-size connector, handy for an older laptop or desktop.
• For extra protocols: YubiKey 5C NFC. Add smart-card/PIV, OpenPGP and OTP workflows without carrying another token.

Plug the key into the computer you’re administering from, not the remote server. A USB-C laptop points toward the C NFC models; a USB-A workstation points toward Security Key NFC. NFC adds a tap-to-authenticate route on supported phones and services. For the SSH walkthrough below, use USB.

Yubico’s Security Key C NFC specifications, USB-A model page and YubiKey 5C NFC specifications establish those connector and protocol differences.

FIDO2-only vs YubiKey 5: what the protocols do

The trap is assuming that “SSH” automatically means you need the 5 series. FIDO SSH works on both families. PIV and OpenPGP are separate ways to use hardware-backed SSH, useful when you already have those workflows.

Job or protocol	Which key family?
FIDO2 / WebAuthn: supported passkeys and browser authentication	Both families
FIDO U2F: older security-key second-factor flows	Both families
OpenSSH FIDO: ed25519-sk / ecdsa-sk	Both families
PIV: smart-card certificates and certificate-based workflows	YubiKey 5 only
OpenPGP: signing/encryption and an alternative SSH route	YubiKey 5 only
OATH-TOTP / HOTP: authenticator codes	YubiKey 5 only
Yubico OTP: Yubico’s separate one-time-password workflow	YubiKey 5 only

Use Yubico’s SSH methods guide to choose the SSH route. For ed25519-sk, Yubico specifies firmware 5.2.3 or newer. Its documented alternative for older FIDO2 firmware is ecdsa-sk.

For Proxmox, pick WebAuthn, not its separate realm-level YubiKey OTP option. WebAuthn is the standards-based security-key route; choosing a 5-series key doesn’t mean you should choose every menu item with “YubiKey” in it.

Buy two, enroll two, test two

A spare becomes useful when each service recognizes it. Register Main key and Spare key as separate credentials on every important account. Generating an SSH credential on the second key creates another public key to authorize; copying the first key’s file doesn’t turn the second token into its twin.

Start with your password manager, primary admin accounts and Proxmox login. Save each service’s recovery codes somewhere you can reach without opening the account you’re trying to recover. Keep the spare separately from your daily key.

You can pair a YubiKey 5 with a FIDO-only spare for shared FIDO logins. That spare covers the FIDO job; it doesn’t supply the main key’s PIV, OpenPGP or OTP credentials. If those extras are central to your workflow, plan their recovery separately.

Set up hardware-backed SSH with ed25519-sk

Use a current OpenSSH client built with FIDO support, plus a server that accepts security-key authentication. Yubico documents OpenSSH 8.2 for basic FIDO support and 8.4 or later for verify-required; use a current supported release on both ends. Its platform setup guide also covers Homebrew OpenSSH on macOS and the Windows client requirements.

1. Set the key’s FIDO2 PIN

Plug in one key. In Yubico Authenticator → Passkeys, choose Set PIN under Manage, enter and confirm it, then Save. Repeat for the spare. Follow the official PIN instructions.

The FIDO2 PIN belongs to the hardware key. The optional passphrase you’ll set on the SSH file is a separate protection for that file.

2. Generate a credential on each physical key

With only the main key connected, run:

ssh-keygen -t ed25519-sk -O verify-required \
  -f ~/.ssh/id_ed25519_sk_main -C "homelab-main"

Follow the PIN and touch prompts, and protect the saved file with a passphrase. Unplug the main key, plug in the spare, then run:

ssh-keygen -t ed25519-sk -O verify-required \
  -f ~/.ssh/id_ed25519_sk_spare -C "homelab-spare"

These examples use nonresident credentials: keep the resulting handle files as well as the hardware. OpenSSH combines a disk-stored handle with a secret that stays on the authenticator. Back up the protected handle files; publish only their .pub counterparts. OpenSSH’s FIDO documentation explains the split and the optional resident-key approach.

3. Authorize both public keys

Using your existing access, add each .pub file as a separate line in the target user’s ~/.ssh/authorized_keys. Preserve the entries already there. To enforce PIN verification at the server, prefix each new security-key line with verify-required followed by a space. Keep the rest of that public-key line intact.

That server option requires a signature attesting user verification; the client-side generation option requests it. Both are documented in the OpenSSH authorized-keys manual.

4. Test without closing your working session

In a second terminal, connect with the main key and its handle file:

ssh -o IdentitiesOnly=yes -o IdentityAgent=none \
  -o PreferredAuthentications=publickey \
  -i ~/.ssh/id_ed25519_sk_main [email protected]

Replace [email protected] with your target account. Those options select the named identity without an agent or password fallback. Disconnect, swap physical keys, and repeat using id_ed25519_sk_spare. Both should complete their own PIN/touch login before you retire any older access method.

Add both keys to Proxmox WebAuthn

For your Proxmox host, start with a trusted HTTPS certificate and a consistent domain name. Configure that before enrolling keys: changing WebAuthn’s identity settings later can invalidate registrations.

1. Open Datacenter → Options → WebAuthn Settings. Review the relying-party identity and origin for the address you actually use; the dialog can auto-fill most setups.
2. Open Datacenter → Permissions → Two Factor, select your account and add WebAuthn. Connect the main key, choose the external security-key option if the browser offers a built-in authenticator first, and complete enrollment.
3. Add the spare as another WebAuthn factor with a distinct description.
4. Create Recovery Keys in the same panel and save them independently. Each recovery code is single-use.
5. Leave your working session open. In a fresh browser session, test login with the main key, then with the spare while the main key is unplugged.

Those requirements and menu paths come from Proxmox’s two-factor setup documentation. Web-UI two-factor authentication and SSH are separate doors: enroll the SSH credentials too.

A remote KVM remains useful for console recovery, but it isn’t a substitute for the spare key and recovery codes that open an account.

Protect the password manager and admin accounts

Bitwarden gives you a straightforward first win. In its web app, open Settings → Security → Two-step login, find Passkey → Manage, name the key, choose Read Key, touch it and Save. Repeat for the spare. Keep your current session open while testing, and save the two-step recovery code outside that vault.

Bitwarden’s instructions distinguish passkey two-step login from passwordless account login and vault unlocking. Here you’re adding a second factor—not replacing the master password or setting up every passkey feature at once.

For other admin accounts, open their security settings and enroll both keys wherever they offer external security keys or WebAuthn. Give the entries recognizable names. When replacing a lost key, use the spare or the service’s recovery process, remove the lost credential, then enroll and test its replacement.

The five-minute spare-key drill

Unplug your daily key. Can the spare sign into Proxmox, your password manager and the SSH account using its own handle? Can you locate the recovery codes without that password manager? If yes, you’ve bought yourself a recovery plan as well as a login button.

Buy Security Key C NFC for USB-C FIDO logins, Security Key NFC for USB-A, or YubiKey 5C NFC for PIV, OpenPGP and OTP. Then enroll the second key before calling the job done.