How-To: Unblock Your Security Key with Keytos Connect

Learn how to unblock your security key in Keytos Connect with your Entra ID account or a government ID and a PUK code from your admin, and then set a new PIN on your YubiKey.

Overview - Why is My Security Key Blocked?

Your security key is blocked when:

  • You just received it. When your IT team sets up a key for you before shipping it, the key arrives blocked so that you can choose your own PIN.
  • You entered the wrong PIN too many times. The key locks itself to protect your account.

Keytos Connect shows a Blocked badge on your security key when this happens. To use your key again, you prove who you are, and then you set a new PIN. You can prove who you are in one of two ways, depending on what your organization allows:

  • Entra ID: Sign in with your work or school account, request an unblock, and wait for your admin to approve it.
  • Government ID: Verify your identity with a government-issued ID and your phone, and enter a PUK code from your admin. Use this if you can’t sign in with your work or school account, for example when your key arrived pre-loaded.

Before You Begin

  1. Install Keytos Connect on your computer. You can find the download links on the Keytos Connect overview page.
  2. Plug your security key into your computer.
  3. If you’re using a government ID, have your ID, a smartphone with a camera, and the PUK code from your IT team ready.

Step-by-Step Guide - How to Unblock Your Security Key in Keytos Connect

Use the tabs below to follow the steps for how you’re verifying your identity.

Step 1 - How to Request an Unblock

  1. Open Keytos Connect and sign in with your work or school account.

  2. On the Identity management page, check that your security key shows Blocked, and then click Unblock a key.

    Keytos Connect Identity management page with the Blocked badge on the security key and Unblock a key highlighted

  3. Under Request to unblock, select Entra ID verification, and then click Next.

    Keytos Connect Unblock a key page with Entra ID verification selected under Request to unblock and the Next button highlighted

  4. Keytos Connect sends your request to your admin, and Unblock a key shows Pending while you wait.

    Keytos Connect Identity management page showing a Pending badge on Unblock a key after submitting an unblock request

Step 2 - How to Set a New PIN After Your Request is Approved

  1. When your admin approves your request, Unblock a key shows Approved. Click Unblock a key.

    Keytos Connect Identity management page with the Unblock a key card highlighted, showing an Approved badge after your admin approves the unblock request

  2. Under Select unblocking method, select Entra ID verification, and then click Next.

    Keytos Connect Select unblocking method page with Entra ID verification selected and the Next button highlighted

  3. Enter your new PIN in New PIN and Confirm new PIN, and then click Unblock. Your PIN must be at least 6 characters, and your organization may require it to include certain types of characters.

    Keytos Connect Enter new PIN page with the new PIN entered in both fields and the Unblock button highlighted

  4. Keytos Connect returns to the Identity management page, and your security key shows Connected.

    Keytos Connect Identity management page showing the security key as Connected after unblocking it

How to Choose Government ID Verification

  1. Open Keytos Connect, enter your work or school email under Enter your email to begin, and click Begin.

  2. Under Select your authentication method, click Legal document.

    Keytos Connect Select your authentication method screen with the Legal document option highlighted to verify with a government ID

How to Verify Your Identity with Your Phone

  1. Keytos Connect shows a QR code. Scan it with your phone’s camera to open the identity verification page on your phone. To verify on this computer instead, click Open in browser instead.

    Keytos Connect Verify your identity dialog with the QR code highlighted, waiting for verification to complete

  2. On your phone, follow the prompts on the Veriff identity verification page. When asked to Take a photo of your document’s photo page, place your ID on a flat surface and take a photo. Accepted documents are an ID card, passport, residence permit, or driver’s license.

    Veriff Take a photo of your document's photo page screen on a phone, with the ID blurred and the list of accepted documents

  3. If you’re using a driver’s license, you’re asked to scan the barcode located on the back of your driver’s license. Turn your license over and hold the barcode in the frame until you see a green check mark.

    Veriff Please scan your barcode now screen on a phone, with the back of a driver's license blurred and a green check mark

  4. When asked to Take a selfie, hold your phone at eye level, center your face in the oval, and tap the shutter button. Veriff compares your selfie with the photo on your ID.

    Veriff Take a selfie screen on a phone with an oval face guide and the shutter button, with the face blurred

  5. Complete any other prompts. When you see Thank you!, your verification data has been submitted. Tap Continue.

    Veriff Thank you screen on a phone confirming the verification data was submitted, with the Continue button

How to Choose to Unblock Your Pre-Loaded Key

  1. Back in Keytos Connect, under What do you want to do next?, click Unblock a pre-loaded key.

    Keytos Connect What do you want to do next dialog with Unblock a pre-loaded key highlighted below Set up your security key

How to Connect Your Security Key

  1. If you see Insert a security key, plug your security key into your computer, and click Refresh.

    Keytos Connect Insert a security key screen asking you to plug in your key, with the Refresh button highlighted

  2. Under Security key detected, check that the Vendor, Model, and Serial number match the key you plugged in, and click Continue.

    Keytos Connect Security key detected screen showing the YubiKey vendor, model, and serial number, with the Continue button highlighted

How to Unblock Your Key with a PUK Code

  1. Under Enter a PUK code from your admin, enter the 8-digit PUK code your IT team gave you, and click Continue. A PUK (Personal Unlocking Key) is a unique code for your security key. If you don’t have one, contact your IT team.

    Keytos Connect Enter a PUK code from your admin dialog with the 8-digit PUK code entered and the Continue button highlighted

  2. Under Create key PIN, enter your new PIN in New PIN and Confirm new PIN, and click Continue. Your PIN protects your security key so only you can use it.

    Keytos Connect Create key PIN dialog with the new PIN entered in both fields and the Continue button highlighted

Done! Your security key is ready to use with your new PIN.

Are you an administrator? See how to approve security key unblock requests and get a user’s PUK in Keytos Shield.