How-To: Review and Fulfill Security Key Requests in Keytos Shield

Learn how to review security key requests in Keytos Shield, assign a YubiKey or smart card to the requesting user with Keytos Connect or the portal, or delete requests.

Overview - What are Security Key Requests in Keytos Shield?

When a user needs a new security key, for example because they just joined or lost their old key, they request one in Keytos Connect. Each request includes the key model they asked for, where they want to receive it, and why they need it. Once the request is approved, your team assigns a key from your security key inventory and gets it to the user.

Want to set up the key before it ships? Your IT help desk can bootstrap the user’s security key with their identity, so it arrives ready to use.

You can fulfill requests in two places:

  • Keytos Connect (recommended): Plug the security key into your computer, and Keytos Connect reads its model and serial number for you, so you can check you have the right model before you assign it.
  • The Shield portal: Type the key’s serial number on the Requests page. The portal doesn’t check that the key matches the requested model.

Each request has one of these statuses in the Shield portal:

Status What it means
Needs key The request is approved and waiting for a security key to be assigned.
Assigned A security key was assigned to the user, and the request is fulfilled.
Denied The request was denied.
Deleted The request was deleted.

The number next to Requests in the left-hand menu of the Shield portal shows how many requests still need a key.

Prerequisites for Managing Security Key Requests

  1. You have completed Keytos Shield identity security onboarding.
  2. You have the Owner or Identity Administrator role on your Keytos Shield subscription.
  3. You have registered security keys in your inventory to assign to users.
  4. To fulfill requests in Keytos Connect, you have installed Keytos Connect on your computer. You can download it from Download the client at the bottom of the Shield portal’s left-hand menu.

Step-by-Step Guide - How to Fulfill a Security Key Request in Keytos Shield

Use the tabs below to fulfill a request in Keytos Connect or in the Shield portal.

How to Open Security Key Requests in Keytos Connect

  1. Open Keytos Connect and sign in with your administrator account.

  2. On the Identity management page, under Admin access, click Manage security keys.

    Keytos Connect Identity management page with Manage security keys highlighted under Admin access

  3. Keep Review security key requests selected in the drop-down. From this drop-down you can also Manage user security keys or Register security keys.

    Keytos Connect Manage security keys drop-down showing Review security key requests, Manage user security keys, and Register security keys

How to Assign a Security Key in Keytos Connect

  1. Click Approved requests to see the requests that are waiting for a key. Requests that still need approval are under Open requests.

  2. Review the request’s Requester, Assign to, Key type, Address, and Reason, and then click Assign.

    Keytos Connect Approved requests tab showing a YubiKey 5 USB C NFC request with the Assign button highlighted

  3. On the Assign a key page, plug in or tap a security key of the requested Key type. You can also type the key’s serial number in the Enter security key serial number box instead.

    Keytos Connect Assign a key page with the Security key card highlighted, waiting for a security key to be inserted

  4. Check that Keytos Connect shows the key as Connected, and that its Model matches the requested Key type. Then click Confirm.

    Keytos Connect Assign a key page showing a connected YubiKey 5 USB C NFC with its serial number and the Confirm button highlighted

  5. Keytos Connect confirms that the security key is assigned. Ship the key to the address on the request, or make it available for pickup in the office, and then click Done.

    Keytos Connect Ship the key page confirming the security key is assigned and ready to be picked up in the office

How to Find Requests That Need a Security Key

  1. Open the Keytos Shield global portal in your browser (US Government Portal) and open your region-specific Shield endpoint under Existing subscriptions.

  2. From the left-hand menu, expand Identity security and click Requests.

  3. Find the requests with the Needs key status. You can click the filter icon next to Status and select Needs key, or type a user’s name in the Search by requester, assignee, etc. box.

  4. Review each request’s details:

    • Requested by and Assign to: The user who made the request and the user who will receive the key. These are usually the same user.
    • Key type: The security key model the user requested.
    • Address: Where the user wants to receive their key, either a shipping address or Pick up in the office.
    • Reason: Why the user needs a new key.
    Keytos Shield Requests list showing request date, status, requester, assignee, key type, address, and reason for each security key request

How to Assign a Security Key in the Shield Portal

  1. Click the ⋮ actions menu at the end of the request’s row and click Assign.

    Keytos Shield Requests list with the actions menu open showing the Assign and Delete options for a security key request

  2. In the Assign a security key to the user dialog, confirm the Assign to, Key type, and Address details.

  3. Get a security key of the requested Key type from your inventory, and enter its serial number. The portal doesn’t check that the serial number matches the requested key type, so double-check the model before you continue.

  4. Click Confirm to assign the key. If you don’t have the key in hand yet, click Assign the key later to close the dialog. The request keeps the Needs key status so you can come back to it.

    Keytos Shield Assign a security key to the user dialog with an example serial number entered and the Confirm button highlighted

  5. Ship the security key to the address on the request, or let the user know it’s ready to pick up.

How to Delete a Request You Won’t Fulfill (optional)

If a request was made by mistake or is a duplicate, you can delete it:

  • In Keytos Connect: On the request, click Delete.
  • In the Shield portal: Click the ⋮ actions menu at the end of the request’s row and click Delete. Deleted requests stay in the list with the Deleted status.