The user's guide provides step-by-step instructions for configuring and using OnlyKey DUO.

Start Here - Unpacking OnlyKey DUO

Step 1. Remove the OnlyKey and the metal quick-connect keychain from packaging.
Step 2. Attach the quick-connect to the OnlyKey, the other end of the quick-connect can be attached to your keyring.
Step 3. (Optional) Check out OnlyKey accessories - iPhone user’s mobile adapter (Lightning)

Proceed to setup below

Setting up OnlyKey

If you wish to just use your OnlyKey DUO as a FIDO security key (webauthn) then no additional setup is required. Register your OnlyKey DUO, then use to login. This is supported by major websites such as Microsoft, Google, Facebook, and GitHub.

If you wish to use your OnlyKey as a hardware password manager, enable other methods of two-factor authentication, or enable secure backup of your device setup OnlyKey DUO with the OnlyKey App.

Proceed to install app below

Install OnlyKey Desktop App

Step 1. Download installer

macOS

Windows

Linux

Step 2. Install and launch the app.

Proceed to OnlyKey setup below

Setup Using OnlyKey App

Step 1. Insert OnlyKey DUO

Step 2. Select [Next] and follow the instructions to enter a backup passphrase

Step 3. If you have an OnlyKey backup to restore, select [Choose File] and select your OnlyKey backup file and then select [Next] to load it onto your OnlyKey. If you do not have a backup just select [Next] to complete the setup.

Your device is now set up and will automatically reboot.

Reset/Factory Default Device

If you ever need to wipe and restore your OnlyKey DUO to factory defaults you can do that by holding down button #1 on device for 10 seconds (device will flash red) then hold down button #2 for 20 seconds. All data on your device will be wiped and you can go through setup again.

You can also use the Self-destruct PIN if one has been set.

Proceed to setup accounts below

Setting up accounts

Prefer a how-to video? Watch one here that demonstrates setting up a new OnlyKey
How-To: Setup Accounts and Customize OnlyKey Preferences

Configure Basic Login Info

The Slots area of the application is where you will set up things like passwords and two-factor authentication. You can see the word ‘‘empty’’ is shown next to a button with a number and a letter. Each of these buttons refer to one of the slots on your OnlyKey.

What are slots? On the OnlyKey DUO you have 3 touch buttons, button #1 has a 1 and is located next to the green light. Button #2 has a 2 and is located on the other side. Button #3 is activated by pressing both buttons 1 & 2 at the same time. Slots correspond to the buttons on OnlyKey, for example pressing button #1 will type login information from slot ‘‘1a’’ and holding button #1 for 1 second with type login information from slot ‘‘1b’’.

What are profiles? In the app you will notice four colors – green, blue, yellow, purple. These colors corrispond to OnlyKey DUOs four profiles. You can hold button #3 down on OnlyKey DUO for 5+ seconds to switch between profiles. The light on OnlyKey will change to green, blue, yellow, purple to indicate which profile is active. Four profiles allows using OnlyKey DUO to store more than just 6 slots (1a, 1b, 2a, 2b, 3a, 3b), there are a total of 24 available slots.

What is stored in slots? In each slot you can set a label, static information like a password, or two-factor authentication. The label is something to help you remember what login information is stored in a slot, slots that have not been configured have no label so they are shown as ‘‘empty’’.

Next, let’s set a label to slot 1a.*

Set a Label

Step 1. Click the 1a button in the OnlyKey app and see the Slot 1a Configuration
Step 2. Enter a label such as Gmail in the Label field, check the box next to Label, and click Submit.

Now the label you entered is assigned to slot 1a in the default green profile. Slot labels are helpful if you forget which button is assigned to which account you can open the OnlyKey app at any time to see how it is set up.

OnlyKey On-The-Go

What if I am using a computer without the OnlyKey app?

Open a text editor and then hold down the 2 button on OnlyKey for 5+ seconds. OnlyKey will type out the slot labels you have set which may look something like this:

GREEN
1a Google
2a Bank
3a Email
1b O365
2b VPN
3b Github
BLUE
1a School
2a Amazon
3a Dropbox
1b
2b
3b
YELLOW
1a Kracken
2a Bittrex
3a Coinbase
1b
2b
3b
PURPLE
1a Protonmail
2a Lastpass
3a
1b
2b
3b

Since OnlyKey types out this information this method works on all computers and even mobile devices.

Another low tech option is to write your labels on a card/paper and carry this in your wallet.

Find out more about TOTP support on-the-go and using OnlyKey with mobile devices (Android and iOS)

Next, let’s assign a password to slot 1a.

Set up a Slot (Basic Login)

The example configuration shown below would be to set OnlyKey to store our Google account password.

Step 1. Click the 1a button in the OnlyKey app, click the checkboxes and enter values as shown:
Step 2. Click submit to save the configuration to OnlyKey:

Now the configuration is saved and shows up in the OnlyKey app as ‘‘Google 1’‘

Step 3. Now to log in we browse to Google login page, if prompted we type our Gmail address and select Next. When presented with the password field we press button #1 on OnlyKey to output the password into the password field.

OnlyKey types your passwords for you so it will work on any device, even on mobile devices.

If you would like to learn more about setting usernames, passwords, and filling custom login forms check out Set up a Slot (Advanced Login)

Next, let’s use two different methods to generate strong uncrackable passwords.

Generate Strong Passwords Online

There are many websites that allow you to generate a secure random password and there are also tools built into many software password managers.

  • Password manager built into KeePassXC
  • Bitwarden password generation tool available here
  • 1password password generation tool available here
  • LastPass password generation tool available here

Generate Strong Password via Browser Extension

Install a browser extension by selecting add to Chrome the same way that you installed the OnlyKey app.

Chrome Extension available from the Chrome Web Store here.

Next, let’s assign a OATH-TOTP secret for MFA

Configure Two Factor Authentication (2FA)

Two-factor authentication (2FA) is essentially an extra step that is required during the login process that makes it so that even if your username and password are compromised an attacker cannot login to your account. It is called two-factor authentication, or sometimes also multifactor authentication, because more than one factor is required to login. Factors can be something you know like a password, something you are like a fingerprint or iris scan, or something you have like the OnlyKey. There are four different types of 2FA supported by OnlyKey. By supporting multiple modes of 2FA OnlyKey will work with most sites that support 2FA - http://www.dongleauth.com/

1) FIDO2 and FIDO Universal 2nd Factor Authentication (U2F)
2) OATH TOTP
3) Yubico® One-Time Password
4) Challenge-Response

OATH TOTP (Google Authenticator)

DISCLAIMER - Google® is the registered trademarks of Google Inc. OnlyKey is not associated with or sponsored by Google® Inc.

Background Information

The way you would typically set this up without OnlyKey is to download an authenticator app to your smartphone. You would then enable TOTP MFA on a website and the website would provide you with a QR code that looks like this:

You would then take a picture of the QR code the website gives you in your authenticator app. The app then starts generating a 6 digit number that changes every 30 seconds that is required to be typed into the website login prompt in addition to your username and password.

This method of two-factor authentication has some notable advantages over using features like 2nd-step verification where a website will send you an SMS message with a code to enter to login. Now that the background is covered we can set this up on your OnlyKey. No phone or app required for setting this up on your OnlyKey but if you wish to maintain a backup of your two-factor authentication codes it may be a good idea to download the app and scan the QR code as a backup in case you lose your OnlyKey.

Step 1. Enable MFA (TOTP) on Website - If you are unsure if the website you want to setup supports TOTP check here. For example to do this for your Google Account you must first enable 2-Step Verification and then you select ‘‘SETUP’’ as shown below:

As you go through the steps you will be prompted to scan a QR code (Looks like a square bar code). You can go ahead and scan the QR code using your smartphone Authenticator app if you wish to create a backup and then select “CAN’T SCAN IT” as shown below:

Step 2. Copy and Paste Code into app - Selecting ‘‘CAN’T SCAN IT’’ will display the private code. Select this text and copy it as shown below:

Now open the OnlyKey App and unlock your OnlyKey. Select the Slot to configure and paste this code into the field located next to ‘‘OATH-TOTP (Google Authenticator)’’ as shown below:

Once you click submit your OnlyKey is ready to generate OTPs.

Step 3. Generate OTP - Place your cursor in the ‘‘Enter code’’ field and press the button that corresponds to the slot that was set. In the example above we set slot 2a so we press the #2 button to generate the OTP.

If you are looking for step-by-step guides on setting up other popular sites with 2FA check out the guides here. Just as with the steps mentioned above, instead of scanning the QR code with an app, click “CAN’T SCAN IT” to copy and paste the text into the OATH-TOTP (Google Authenticator) field of the OnlyKey app.

To find out if a specific website is supported there is a full list of websites and wether or not they support 2FA here. To see if a certain site is supported see that there is a check next to “One Time Passwords (OTP)”

TOTP (Google Authenticator) On-The-Go

One requirement of TOTP (Time-based One-time Password) is having the correct time. If OnlyKey is used on a system where the OnlyKey app is not running it will type out “NOTSET” instead of the OTP code. Because OnlyKey has no battery it requires an app to send it the correct time to be able to generate TOTP codes. For this reason it is important to ensure the OnlyKey app is permitted to autostart.

However, OnlyKey TOTP will work on-the-go without the app running. All you have to do is browse to our web app https://apps.crp.to in Google Chrome or Firefox. This web app in addition to being used to send encrypted messages sets the current time on OnlyKey and login with TOTP will function as normal.

Yubico® One-Time Password

DISCLAIMER - Yubico® and Yubikey® are the registered trademarks of Yubico® AB. OnlyKey is not associated with or sponsored by Yubico® AB. Yubikey® OTP has been released by Yubico® as open source software with license found here

  • Select the ‘‘Hide values’’ checkbox and select ‘‘Regenerate’’ to create a Public Identify, Private Identity, and Secret Key.
  • Copy and paste these into the corresponding fields in the OnlyKey App Full Configuration (Advanced) tab.
  • Select ‘‘Set Slot’’ to write these values to your OnlyKey
  • Now your OnlyKey is ready to function in Yubikey® OTP mode
  • The Yubikey® OTP will be generated when the corresponding button is pressed.

Yubicloud (Not Officially Supported)

Some online services use Yubicloud for authentication. Yubicloud is owned by Yubico® and 3rd party devices are not supported so OnlyKey is not supported on Yubicloud. However, 3rd party devices will technically work with Yubicloud as long as you own an actual Yubikey®.

The following instructions show you how to set up a 3rd party device on Yubicloud. This is for your information only and we do not recommend setting up a 3rd party device on Yubicloud. If you choose to follow this information to set up a 3rd party device on Yubicloud you choose to do so against our recommendations and at your own risk.

Step 1. Download and install the Yubikey® personalization tools
Step 2. Go into Yubico® OTP and select ‘‘Quick’’
Step 3. Insert Yubikey®, select a configuration slot, and click ‘‘Write configuration’’ button
Step 4. Set the values shown in the Public Identity, Private Identity, and Secret Key to your OnlyKey.
Step 5. Once this is complete select ‘‘Upload to Yubico®’’
Step 6. This will open a web browser, to complete the registration enter the OTP in the ‘‘OTP from the Yubikey®’’ field by pressing the button on your OnlyKey.
Step 7. Once the form is complete enter the Captcha and select Upload AES key.
Step 8. Now you can test your OTP generated by OnlyKey on the site https://demo.yubico.com/otp/verify

Security Key - FIDO2, FIDO U2F, and WebAuthn

No setup is required to use OnlyKey as a security key. When registering and authenticating OnlyKey as a security key you will see OnlyKey flash blue. To use OnlyKey as a security key follow the instructions given by the website where you wish to register OnlyKey. When using Onlykey as a security key you will see the light flash blue, press any button on the OnlyKey to register or login to a site. While your device is flashing blue typing is disabled in case you also have a slot set up for basic login.

The terminology for security keys can be a bit confusing so here are some quick definitions to make sense of it.

When websites use the term security key they typically are referring to one of these:

  • Universal 2nd Factor (FIDO U2F) - Security key is used just as a 2nd factor along with your password. This is what most websites use.
  • FIDO2 - A replacement for FIDO U2F released in 2019, security key may be used as a 2nd factor along with your password or may be used as a passwordless security key on supported applications. Passwordless authentication allows logging in with just a security key and a PIN code.

The term WebAuthn is sometimes used instead of FIDO2, essentially WebAuthn is the web browser standard and is part of the larger FIDO2 project.

Security Key Advanced

As mentioned above, FIDO U2F works as a 2nd factor and is supported for an unlimited number of sites. FIDO2 has some additional options such as resident credentials and extensions that are not yet supported by most sites or applications.

FIDO2 Resident Credentials

With resident credentials you can create a smoother, username-less login experience by saving some of the user data on the security key. To try it out we recommend using https://www.passwordless.dev/usernameless. As shown on the site not all browsers support this feature:

One drawback of resident credentials is that physical devices have limited storage. OnlyKey stores up to 12 resident credentials. In the event this fills up resident credentials can be managed and removed with the OnlyKey CLI

FIDO2 Extensions

FIDO2 allows support of extensions such as the HMAC SHA1 extension for challenge-response which is supported by OnlyKey.

Challenge-Response

Challenge response is a form of authentication where an application sends a unique challenge and OnlyKey sends back an HMACSHA1 response. This response may be used for things like encryption of data which is used by software such as KeePassXC. OnlyKey flashes yellow when a challenge is received and user presses any button on OnlyKey to authorize the response. OnlyKey supports customizable “HMAC User Input Mode” which allows the user to select if button press is required for challenge-response.

By default, no setup is required for challenge-response as OnlyKey has random HMAC key set by default and two available HMAC slots.

Advanced

Challenge-response is compatible with Yubikey devices. This permits OnlyKey and Yubikey to be used interchangeably for challenge-response with supported applications. In order to use OnlyKey and Yubikey interchangeably both must have the same HMAC key set. To set HMAC key on YubiKey we recommend using the Yubikey Personalization Tool.

For example, a random secret key may be generated and loaded into slots 1 and 2 on Yubikey:

The same secret key may be loaded into HMAC slots 1 and 2 using the OnlyKey App. Make sure to pad the end with 0s like this:

You will see a success message in the app “Last message received: Successfully set” indicating it loaded successfully

This may also be loaded into slots 1 (130 in CLI) and 2 (129 in CLI) using the OnlyKey CLI.

Setting the same HMAC key (40 characters, 20 bytes hex) allows OnlyKey/Yubikey devices to generate the same responses and be used interchangeably.

Using OnlyKey With A Software Password Manager

OnlyKey stores up to 24 unique accounts in offline storage and can be used to secure an unlimited number of accounts if used in conjunction with a software password manager. For example, set one of the OnlyKey slots to KeePassXC, Dashlane, Google (Smart Lock), Lastpass, etc. enable 2-factor on this slot and then use your OnlyKey to unlock your software password manager. This way you can keep your most valuable accounts in offline secure hardware and everything else in the software password manager.

There are two types of software password managers:

  • Online Password Managers - Less secure but more convenient because passwords sync automatically between devices
  • Offline Password Managers - More secure but less convenient because passwords don’t sync automatically

KeePassXC

What’s great about KeePassXC:

  • Its 100% open source (verifiable security)
  • Its cross platform, supports Windows, Linux, Mac (in contrast to KeePass which is for Windows)
  • Its offline, no passwords in the cloud
  • We collaborated with the KeePassXC team to develop a custom integration with OnlyKey that provides a major security benefit

Starting with the 2.5.0 release of KeePassXC you can use OnlyKey in challenge-response mode to secure your KeePassXC password database.

Windows Install

macOS Install

  • Download and install KeePassXC from https://keepassxc.org/download/#mac
  • An additional step is required in macOS 10.15 Catalina
    • Go to Settings -> Security & Privacy -> Input Monitoring
    • Unlock and click the +
    • Select KeePassXC and click open

This additional step is required so that KeePassXC has permission to access your OnlyKey

Linux Install

KeePassXC Setup

You can either import passwords to a create a new KeePassXC database by going to Database -> Import, or create a new empty KeePassXC database by selecting “Create a new KeePassXC database”

  • Give your Password database a name and continue
  • Select continue again to keep default encryption settings
  • Enter a master password for your password database, click the dice to randomly generate one
  • (Optional) Copy the master password and save it to one of your OnlyKey slots using the OnlyKey app
  • Select “Add additional protection”
  • Select “Add YubiKey Challenge-Response”
  • OnlyKey will show in the list of devices, select slot1 or slot2 and click done
  • OnlyKey will flash yellow, press any button, if importing OnlyKey may flash yellow several times, press any button when it does this to complete import
  • Congrats! You now have a new password database

KeePassXC Settings/Sync

  • Click on the wrench icon in KeePassXC to customize settings
  • To enable browser integration (where KeePassXC can autofill account information in browser) click the Browser Integration icon, check the Enable browser integration checkbox, and select the browsers to enable
  • Install the KeePassXC Browser plugin https://keepassxc.org/docs/keepassxc-browser-migration/
  • To enable the SSH Agent click the SSH Agent icon and check the Enable SSH Agent checkbox. With this feature enabled your OnlyKey will be required to SSH.

KeePassXC Cloud Sync While your KeePassXC database is encrypted and can be synced to multiple devices by copying it to cloud drive a better option that we recommend is to use Cryptomator.

  • Download and install Cryptomator
  • Create a vault inside of your cloud drive synced folder (i.e. Onedrive, Google Drive, etc)
  • You can optionally store the vault password in one of your OnlyKey slots
  • Move your KeePassXC kbdx file to your Cryptomator vault
  • Congrats! You now can access your new password database from any computer with Internet access, Cryptomator, and your OnlyKey.

What is needed to use the challenge-response feature? No setup is required, OnlyKey generates a private key for HMACSHA1 automatically when the device is first configured. After creating the KeePassXC database you will be prompted to press any button on OnlyKey (flashes yellow) to unlock your KeePassXC database. Additionally, since OnlyKey also stores static passwords you can use OnlyKey to store your KeePassXC master password in one of the available slots.

What is challenge-response? Your passwords are stored in an encrypted Keepass container, in addition to requiring a master password to decrypt, a response (HMAC SHA1) from OnlyKey is required. The OnlyKey flashes yellow and you must press a button on OnlyKey. By requiring a master password and an OnlyKey, your accounts are protected by two layers of security. This solution is more secure than software password managers that only rely on a master password. Here is a threat model explaining why -

In order to unlock your KeePassXC database a hacker would need four things:

  • Access to your computer (where the KeePass database resides)
  • Physical access to your OnlyKey
  • Know your OnlyKey PIN
  • Know your master password

LastPass

LastPass supports both Google Authenticator and Yubico® OTP. Google Authenticator is supported in the free version of LastPass and Yubico® OTP is supported in the premium version of LastPass.

To protect LastPass account with Google Authenticator 2FA follow the steps below.

Step 1. Go into Account settings-> Multi-factor Options and select the edit button in the Google Authenticator column.
Step 2. Change to enabled and select View button next to Private Key
Step 3. You will be prompted to enter your master password and then the key is displayed.
Step 4. Copy and paste the key into the Google Auth OTP field of the OnlyKey app for the slot that you want to set up.
Step 5. Make sure to check the radio button next to Google Auth OTP and select Submit.
Step 6. Go back to the LastPass app and select Update. You will be prompted for your password again and then your current verification code. Click inside the verification code box and press the button assigned to the slot you set up on your OnlyKey to type out the verification code.

DashLane

DashLane supports Google Authenticator, Yubico® OTP, and Security Keys. The security key (FIDO2 / U2F) option is the most secure option.

Google SmartLock

SmartLock is a password manager that is available in Google Chrome, it supports Google Authenticator and Security Keys. The security key (FIDO2 / U2F) option is the most secure option.

Preferences

OnlyKey has several customizable preferences that can be accessed from the preferences tab of the configuration app.

Configurable Inactivity Lockout Period

This is the amount of time that the OnlyKey should remain unlocked while not being used. The default value is 30 minutes and the maximum is 255 minutes (about 4 hours). To disable lockout altogether set the lockout to 0.

Configurable Keyboard Type Speed

Setting a custom type speed may be desirable in cases where the application you are using can not keep up with fast typing. Or if you don’t use any applications with type speed restrictions you can have the text typed at top speed for the fastest logins. Setting value to 1 will result in very slow type speed of about one character a second, setting value to 10 will result in very fast type speed that will type almost instantly.

Configurable Keyboard Layouts

You can change your keyboard layout on the fly through the OnlyKey app preferences. Traveling to France from the US? No problem just set the OnlyKey keyboard to French and change it back to US when you return. Here are the options supported for international keyboards:

  • US_ENGLISH
  • CANADIAN_FRENCH
  • CANADIAN_MULTILINGUAL
  • FINNISH
  • FRENCH
  • FRENCH_BELGIAN
  • FRENCH_SWISS
  • GERMAN
  • GERMAN_MAC
  • GERMAN_SWISS
  • ICELANDIC
  • IRISH
  • ITALIAN
  • NORWEGIAN
  • PORTUGUESE
  • PORTUGUESE_BRAZILIAN
  • SPANISH
  • SPANISH_LATIN_AMERICA
  • SWEDISH
  • TURKISH
  • UNITED_KINGDOM
  • US_INTERNATIONAL
  • CZECH
  • SERBIAN_LATIN_ONLY

Note: These additional keyboard layouts are available but cannot currently be set using the OnlyKey app. To set these keyboard layouts use the OnlyKey CLI here.

  • DANISH MAC
  • HUNGARIAN
  • US_DVORAK

Derived Key User Input Mode

OnlyKey supports automatic generation of keys that may be used for SSH and PGP/GPG with the OnlyKey Agent.

The default setting is “Challenge Code Required” which requires a 3 digit challenge code to be entered on OnlyKey to perform SSH or PGP/GPG operation. This is great for security but for some users a more convenient approach may be preferred. With “Button Press Required”, a physical press on any key is all that is required to perform the operation.

Stored Key User Input Mode

OnlyKey supports import of existing OpenPGP keys using the OnlyKey app. These keys once imported are securely stored in OnlyKey hardware and may be used to perform SSH or PGP/GPG operations with the OnlyKey Agent or in the browser with the OnlyKey WebCrypt.

By default, you must enter a 3 digit challenge code on OnlyKey to perform SSH or PGP/GPG operation. If a more convenient approach is preferred “Button Press Required” may be set so that a physical press on any key is all that is required.

HMAC Mode

OnlyKey supports HMAC challenge-response. By default, user input (button press) is required on OnlyKey to perform HMAC operation. For some use cases such as full-disk encryption no button press may be preferred. With “Button Press Not Required”, HMAC challenge-response operations may be performed without user interaction.

Backup Key Mode

You can change your backup key/passphrase at any time by entering your PIN to put the device in config mode. By setting backup key mode to locked, the backup key/passphrase may not be changed. This setting provides extra security so that even if an adversary has your PIN and has physical access to your device they would not be able to backup and restore your data.

Configurable Wipe Mode

Setting wipe mode to “Full Wipe” ensures that not only is your sensitive data wiped when a factory default occurs but also the firmware is wiped. This ensures that no data or meta data such as what version of firmware you had would be accessible to an adversary that steals or otherwise obtains a user’s OnlyKey and then performs a factory default. The tradeoff of setting wipe mode to full wipe is that this cannot be changed once set and when a factory default occurs the firmware must be reloaded using the firmware upgrade guide. For user’s desiring the highest level of security we recommend enabling full wipe.

Sysadmin Mode

By default, OnlyKey may only type regular keyboard characters, TAB, and RETURN. This is useful for entering usernames, passwords, etc. For more advanced use cases such as for system administrators it may be helpful to utilize modifier keys to save time while entering common keystrokes such as CTRL-ALT-DEL, and then entering a username/password. With “Sysadmin Mode” set this permits the use of the following modifier and additional keys to be stored and typed by OnlyKey:

  • Ctrl (\c)
  • Shift (\s)
  • Alt (\a)
  • Windows (PC) or Clover (Mac) (\g)
  • Tab (\t)
  • Return (\r)
  • Printscreen (\p)
  • Home (\h)
  • Page Up (\u)
  • Page Down (\o)
  • End (\e)
  • Delete (\d)
  • Backspace (\b)
  • Arrow-Up (\U)
  • Arrow-Down (\D)
  • Arrow-Left (\L)
  • Arrow-Right (\R)
  • Escape (\E)
  • Delay (#) # is number of seconds to wait

Once enabled, this can be used like this:

i.e. To press Ctrl-Alt-Del, release Ctrl-Alt-Del, delay 3 seconds, press TAB, enter username, and enter password:

 \c\a\d  \3 USERNAME \t PASSWORD

Notice that a {space} followed by the \ character is used to begin \c\a\d and one space is used to end (resets modifier keys). To use one space to start and one to end for multiple actions there will be two spaces in between actions like:

{space} {\} {c} {\} {a} {\} {d} {space} {space} {\} {3} {space} {USERNAME} {space} {\} {t} {USERNAME}

Here are some other common examples:

  • To open terminal in Linux, then delay two seconds, then enter a command into terminal (2 second delays added)
 \g  \2 terminal \r  \2 ssh user@domain \r
  • To press Windows key and open run box, then delay, then enter a powershell command (2 second delays added) 
     \g  \2 run \2  \r  \2 powershell.exe ls \r
  • To press Windows key and run cmd command to open calculator (2 second delays added) 
     \g  \2 cmd \r calc \2  \r
  • To enter text into fields 1, 3, and 5 of a multiple field form and then submit 
     \t textfield1 \t  \t textfield3 \t  \t textfield5 \r

Configurable Lock Button

One of the buttons on OnlyKey can be configured as a lock button. When the lock button is pressed the OnlyKey locks and the OnlyKey sends keystrokes to lock the computer (Windows+L for Windows and Linux, CTRL+SHIFT+EJECT for Mac).

Configurable Indicator Light (LED) Brightness

The multicolor LED on OnlyKey is set to medium (8) brightness by default. Brightness may be adjusted between 1 (dimmest) and 10 (brightest).

Change your PIN

To change PIN go to the [Setup] tab, put OnlyKey in config mode, and follow the instruction in the app to set a new PIN.

Encryption Keys

OnlyKey makes encryption keys easier and more secure by storing them offline, protected even if the computer using the encryption key is compromised.

Key FAQ

What is a key?

In the simplest terms an encryption key is something you have that allows you to encrypt or sign data. This data could be emails, files, or anything really. Every time you browse to a secure website there are keys being used in the background to encrypt the information you send so that only you and the website can see the information.

Why does protecting private keys matter?

You may hear the term private key being used sometimes, we will not get into the details here but there are plenty of places to read further on this topic online. For our purposes here a private key is used to read the secure messages / data that someone sends you. Only you should have access to this key because anyone with access to the key can read all messages sent to you in the past or in the future. This is why it is important to protect the key from exposure and why storing it securely on the OnlyKey is better than on your computer somewhere.

What does OnlyKey use keys for?

The OnlyKey stores private keys. These private keys are used for three different purposes.

  1. Signing and Encrypted Messages/Files (OpenPGP)
    • OnlyKey WebCrypt - Provides a way to securely use OnlyKey for OpenPGP in the browser. The Webcrypt app loads everything necessary to encrypt messages and files directly in the local browser without the need to send messages or files over the Internet. Data between OnlyKey and the local browser is end-to-end encrypted. This provides encryption everywhere on-the-go and supports macOS, Windows, Linux, Chrome OS, Android, and iPhone (Safari on iOS 13.3+). More information on mobile support here.
  • OnlyKey GPG Agent - Provides a way to securely use OnlyKey for OpenPGP on a local computer. Instead of keeping keys on a computer, OnlyKey generates and securely stores your keys off of the computer and you can still easily use GPG to do things like sign emails, git commits, software packages etc.
  1. SSH Authentication - SSH is a popular remote access tool that is often used by administrators. Thanks to the OnlyKey SSH Agent remote access can be passwordless and more secure. For information on using OnlyKey for SSH authentication see OnlyKey SSH Agent.
  2. Secure Encrypted Backup - This will backup everything including your stored accounts, preferences, and other keys to an encrypted text file. For information on backing up OnlyKey see Secure Encrypted Backup.

How do I get started?

By default, no setup is required to use OnlyKey GPG Agent and OnlyKey SSH Agent as OnlyKey uses random key (derived keys) by default.

To use OnlyKey WebCrypt or OnlyKey Agent with your own OpenPGP keys (stored keys) follow the guide here to generate and load OpenPGP keys onto OnlyKey.

Secure Encrypted Backup Anywhere

The Secure Encrypted Backup Anywhere feature allows you to backup OnlyKey on the go. The way that this works is that the OnlyKey encrypts everything on your OnlyKey using an encryption key and then types it out. This allows saving the backup in a text file or email on any computer.

Backup With OnlyKey App

Step 1. First, you must have a backup passphrase or key set on your OnlyKey.
Step 2. Click on the Backup/Restore tab of the OnlyKey app.
Step 3. Click inside the Backup data box and then hold down the 1 button on your OnlyKey for 5 seconds or more and then release. This will type out an encrypted backup of your OnlyKey configuration into the box. Select save file to save the backup file which has a timestamp so you can keep track of the latest backup file.

Backup Without OnlyKey App

The process is the same to backup without the app. OnlyKey can type out your encrypted backup anywhere.

Save to a text file - Instead of clicking in the Backup data box you could click into any text editor like notepad and when the backup is complete save the text file using whatever filename you prefer.

Save it in an email - In the same way you could also click into any email client and then when the backup is complete send the email to yourself or someone else.

Restore From Backup

Using the backup file created in the Secure Encrypted Backup Anywhere section, OnlyKey can be restored to a previous state. This also allows restoring to a different OnlyKey or a second OnlyKey in order to have an extra.

Step 1. Ensure that the same passphrase/key is loaded onto the OnlyKey that was used to backup.
Step 2. Put the OnlyKey into config mode by holding the 6 button down for more than 5 seconds, and then re-entering your PIN. You will see the OnlyKey LED fade in and out continuously (Red) while in config mode.
Step 3. Click on the Backup/Restore tab of the OnlyKey App and then click Choose File to select your OnlyKey backup file. Click Restore to OnlyKey.

If you used the OnlyKey App to create the backup then the name of this file will be ‘‘onlykey-backup-.txt''. The timestamp can be used to make sure you are loading the latest backup.

Step 4. Restore may take a minute or two depending on the amount of data to restore. You will know that the restore is complete when the OnlyKey reboots automatically.

Loading OnlyKey DUO Firmware

Backup OnlyKey - It is always a good idea to create a backup prior to upgrading. Do this by going to the Backup/Restore tab in the OnlyKey app. Ensure you have a copy of your backup key/passphrase (User Guide Backup Instructions here).

Download Firmware

There is a tab named Firmware in the app. This may be used to load the latest firmware onto OnlyKey directly through the OnlyKey app.

Load Signed Firmware

  • Go to the Firmware tab in the app
  • Follow the instructions in the app to load firmware

OnlyKey Accessories / Mobile Support

Extra USB-C Outer Shell

The OnlyKey DUO outer shell provides USB-C and additional protection.

Purchase in OnlyKey Store

Android/iOS Support

Android and iOS is supported by using a USB on-the-go (OTG) adapter. For more information read Using OnlyKey with Mobile Devices (Android and iOS)

Set up a Slot (Advanced Login)

Once OnlyKey DUO is PIN protected multiple values can be set to a slot, let’s assign a username AND password to slot 1b.

The example configuration shown below would be to set OnlyKey to store our Dropbox username and password.

Step 1. Click the 1b button in the OnlyKey app, click the checkboxes and enter values as shown:
Step 2. Click submit to save the configuration to OnlyKey:

Now the configuration is saved and shows up in the OnlyKey app as ‘‘Dropbox’‘

Step 3. Now to log in we browse to Dropbox login page, click on the username field and hold button #1 (for more than one second) on OnlyKey to output the username and password into the login field.

While the username, tab, password, return format covers many login pages there are lots of custom login pages and OnlyKey has features to match those custom login scenerios.

If you need OnlyKey to fill a custom login form that does not fit into the basic login format i.e. You need to perform the following:

  • Enter the Username
  • Press RETURN
  • Wait for website to load next page
  • Enter the password
  • Press RETURN

Delays may be set to allow for the web page to load.

Step 1. Click the 2a button in the OnlyKey app, select the Full Configuration (Advanced) tab, click the checkboxes and enter values as shown:
Step 2. Click submit to save the configuration to OnlyKey:

Now the configuration is saved and shows up in the OnlyKey app as Custom Login

Step 3. Now to log in we browse to custom login page, click on the username field and press button #2 on OnlyKey to output the username and press RETURN. OnlyKey then waits 3 seconds for the page to load before entering password into the password field.

While this covers the majority of login scenerios there still may be some that don’t fit the template. If you need OnlyKey to fill a custom login form that does not fit into the template i.e. You need to perform the following:

  • Enter the Username
  • Press TAB
  • Press RETURN
  • Wait for website to load next page
  • Enter the password
  • Press TAB
  • Press RETURN

    You can enter ‘ \t’ or ‘ \r’ inline with slot data to type the extra TAB or RETURN and ‘ \d3’ to DELAY 3 seconds.

Where in the username field the value is set to:

onlykey \t  \r  \d3

Where in the password field the value is set to:

password \t  \r


You can chain together multiple ‘ \t’ or ‘ \r’ in the fields. Its one space to start and one space to end so if your chaining together multiple tabs it would have a double space in between like:

{space} {\} {t} {space} {space} {\} {t} {space} {password} {space} {\} {r}

To do even more like press special keys such as Ctrl-Alt-Del OnlyKey has a special mode that enables filling virtually any form or login. See Sysadmin Mode for more details.

Additionally, by using the URL field in Full Configuration (Advanced) we can have the OnlyKey type the login page URL into the browser and browse to the login page. This way a one-touch login is possible. Just select the empty URL field in the browser and the URL is automatically typed out and Return is pressed to browse to the site. Once on the site loads the password is entered and the login is complete.

The example configuration shown below would be to set up a URL and password to automatically login to the Google page shown below. Notice that the username is already remembered by the website, so there is not a need to set this in the OnlyKey slot.

Test a Slot

Once you set your desired account information to a slot then try it out by going to the login page, clicking in the login field, and pressing the corresponding button on the OnlyKey.

Common issues:

  • The password is entered before page loads.
    • Set the delay, usually 2-3 seconds works well but this may not be enough time for slow web pages or slow internet connections.
  • There is a Captcha required sometimes after password
    • You can either set the delay to a high value like 9 seconds to give yourself time to enter this or select None. Selecting None means that the password is entered but not submitted so you have time to enter additional information.
  • Everything works fine but I really wish it typed faster.

These examples illustrate how to use OnlyKey in two real world scenarios. A key takeaway here is that you can configure OnlyKey to automatically do what you would normally do manually. Any combination of the fields shown in the slot configuration may be used or not used to fit login format.


The table below shows how to configure some common login forms that at first may seem problematic.

Login Format Configuration
Site that does not automatically select username field after loading page (i.e.Kracken).
With URL - You will notice that "Tab before UserName" is checked. This will select the username field as it is not automatically selected when the page loads.
Without URL - Browse to the login page first and place cursor in the username field before selecting the assigned OnlyKey button.
Site where username is remembered after first login (i.e. Google). Password and 2FA only - This is usually the best option if you remember your username/email address as this will work on any computer whether your username is remembered or not. This method does not include URL in case you are prompted for a password.
Username Remembered w/URL - If you use your device mostly on a computer where you username is remembered this is a good option. If you use this configuration on a computer where username is not remembered then you must output of the login information into notepad and paste into login fields.
Site that does not automatically select OTP code field (i.e. Salesforce)
After loading next page
You will notice that "Tab before OTP" is checked. This will select the OTP field as it is not automatically selected when the page loads.
Site where username and password is required first and then OTP code field appears below (i.e. IT Glue)

Troubleshooting

Common Issues

Below is a list of common issues and solutions.

Issue Solution
White Light on OnlyKey If full wipe mode is enabled (disabled by default) the OnlyKey will wipe both data and firmware. Follow instructions in the upgrade guide here to load firmware.
Not working with certain sites / Not entering data in correct field We often get customers that ask how to set up a specific site with OnlyKey. There are several examples listed in the table provided in the Set up a slot section. If you have a use case that is not covered by this please open a new issue on the support forum.
Missing characters while typing / typing too fast / typing too slow Adjust the type speed in preferences.
Google Authenticator types NOTSET instead of OTP code This occurs when the OnlyKey does not have the time set. Time is set from the OnlyKey app which occurs automatically. The OnlyKey app must be installed for the code to be generated.
Entering data into OnlyKey App and selecting submit but the data is not saved The check box next to the data must be selected.
Yubico® OTP Error The majority of Yubikey® OTP applications require Yubicloud setup including LastPass. See Yubicloud section of User's Guide.

If you have an issue not listed here please reference the online support forum here.

Documentation - https://docs.crp.to

FAQs - https://docs.crp.to/faq.html

Forum - https://forum.onlykey.io

Store – https://crp.to/ok

Github – https://github.com/trustcrypto

Getting started with OnlyKey – https://onlykey.io/duo

Tags:
Edit me