Multi-Factor Authentication (MFA), Hardware Tokens and Security Keys

Hardware tokens and security keys are small, portable devices that can be used for Multi-Factor Authentication (MFA). If you don't have a device compatible with the Duo Mobile app, or do not want to use a personal device for MFA, you can use a hardware token purchased from the Webstore instead. Hardware tokens also do not depend on connectivity to the internet.


Obtaining a Hardware Token

Only tokens purchased through the University of Illinois Webstore are fully supported for authentication at both Duo Prompts. They are set up with the private identity and secret key for the University's MFA service. The University has a tightly controlled provisioning process to meet the University's security needs.

While any staff or faculty member can purchase a token through the University of Illinois Webstore, you may want to check with your manager or department lead on the process for providing tokens to its employees. Students are also eligible to purchase hardware tokens. Upon purchase, tokens can be delivered via campus mail or USPS at no charge.  Tokens can only be used with University resources.  Unit purchases are considered property of the University and token use must comply with all appropriate policies.

Users can also bring their own WebAuthn/FIDO2 compatible security keys for authenticating at a Duo Universal Prompt (Urbana, Chicago, and Springfield login pages), with the following caveats:

  • These will not be able to be used for authentication at AITS-hosted Duo prompts such as at the NetID Center or when logging into sites (Banner, HR systems, My UI Info, etc). Because of this, we recommend that you have a backup authentication option set up.
  • Support is limited for security keys not purchased through the Webstore.

Hardware Token Options

There are currently three hardware token options sold by the Webstore:

Token Comparison
 Token Type Yubikey (USB-A) OTP C100 2FA Yubikey (USB-C)
Product Image  Yubikey 5 NFC  OTP C100
Description A small USB device that you insert into your computer.  You press a button on the token to generate and automatically enter a passcode into the Duo prompt.

The Yubikey is the preferred option in terms of accessibility, particularly for those visually impaired.

User will need access to the USB device in order to authenticate.  If it is not within reach, the OTP C100 would be a better option.
A small electronic device that can be attached to a keyring.  It has a single button that you press to generate a passcode that you then manually enter into the screen when prompted. This physical token can be purchased for use with the University's Verify 2FA system to access information systems such as Banner or My UI Info. Most people are able to perform this function using their personal cell phone with either SMS text messaging or via the Duo app. This token can be used by individuals unable (due to limited service/functionality) or unwilling to use their personal device to perform the required 2FA function
Dimensions 18mm x 45mm x 3.3mm 29mm x 62mm x 11mm 18mm x 45mm x 3.3mm
Weight 3.0g 14.4g 3g
Price University of Illinois WebStore University of Illinois WebStore $52.75
Requirements Any computing device with a USB-A port No hardware requirements USB-C port

Registering and Using your Hardware Token or Security Key

Note: The Yubikey model currently sold by the Webstore (Yubikey 5 NFC) can be used as a standard U2F hardware token, or it can be used as a security key using more modern and secure WebAuthn/FIDO2 authentication standards. Currently, only the Duo Universal Prompt used by Urbana, Chicago, and Springfield login pages support these standards. Instructions on how to enable this extra functionality will be mentioned below.

Please follow the instructions for your device:

Yubikey Hardware Token functionality


To register your Yubikey as a basic U2F hardware token, you must use the NetID Center.

  1. Visit the NetID Center at
  2. Click Login and login with your NetID and password then authenticate with 2FA if applicable
  3. Click Manage my 2FA
  4. Click + Add a new device
  5. Click Hardware Token
  6. Type in the serial number of your device which can be found on the back of the hardware token.  
  7. Click Continue
  8. Insert the Yubikey in the USB port of your computer with the gold button facing up. It will take a few seconds to register the first time.
  9. Make sure that CAPS Lock is off, then press the gold button on the Yubikey. It will generate a passcode for you and your device will be registered.
  10. Your hardware token is now ready for use.


Select the option for Yubikey, make sure your device is plugged in, and that CAPS Lock is off. Then press the gold button on the Yubikey.

Duo Universal Prompt

Duo Universal Prompt Yubikey

AITS Custom Duo Prompt

AITS iFrame showing Yubikey

Yubikey or B.Y.O.D. WebAuthn/FIDO2 Security Key functionality (more secure)

As mentioned above, only the Duo Universal Prompt (Urbana, Chicago, and Springfield login screens) support this newer authentication method.


  1. From a Duo Universal Prompt, click on Other options then Manage devices.
  2. After authenticating, you will be in the device management portal.
  3. Click on Add a device, then click on Security key.
  4. Click on Continue.
  5. Follow the prompts from your browser and operating system for adding your security key.
  6. Plug in and touch your security key. If prompted, enter the PIN for your security key.
  7. Your device is ready for use. If your Yubikey was purchased from the Webstore and you set it up in the NetID Center, it will appear twice (once for each protocol).
    Device added, Yubikey shows up twice.


When prompted, touch your security key to authenticate.

Duo Universal Prompt security key

C100 OTP Token


The C100 OTP Token can only be registered via the NetID Center.

  1. Visit the NetID Center at
  2. Click Login and login with your NetID and password then authenticate with 2FA if applicable
  3. Click Manage my 2FA
  4. Click + Add a new device
  5. Click Hardware Token
  6. Type in the serial number of your device which can be found on the back of the hardware token.  
  7. Click Continue
  8. Confirm Token by pressing the red button on your token.  It will generate and display 6-digit code.  Manually enter this code into the box and select Enter.
  9. Your hardware token is now ready for use.


Duo Universal Prompt

Select the option for hardware token and then enter the code from your device.

Universal prompt hardware token screen

AITS Custom Duo Prompt

Select the option for hardware token and then enter the code from your device.

Additional Information

Forgotten hardware tokens

If you forgot your token and cannot log into the system requiring 2FA, visit NetID Center - Get temporary passcode at the bottom of the page.

Lost hardware tokens

If you lose your hardware token, you should immediately sign into the NetID Center using an alternate method or by generating a bypass code. Once in the NetID Center, click on "Manage my 2FA". Here, select the lost token and click the red trash can icon to remove it. This way the token cannot be used by someone else to access your account. If you find the token, you can follow the above steps again to register it to your account once more.

Registering a hardware token to another employee

Tokens can be reassigned for use by another employee.  The new owner of the token can register it to themselves by following the instructions listed above.

Hardware Token Issues

If your Yubikey is not authenticating, make sure that CAPS LOCK is turned off and try again.  If still an issue, please proceed with the below steps:
  • Please note: Faulty tokens will be replaced up to 6 months from the time of purchase.  Please reference your purchase receipt number when requesting a replacement.
If your token is not generating a code or is not registering properly, you can visit your University Service Desk.  They can troubleshoot the issue or possibly exchange your token.  
  • Urbana - Digital Computer Lab 1211
  • Springfield - Information Security Office, Human Resources Building (HSB), Room 133
  • Chicago - Please email and a staff member will follow up for an appointment.
If you work remotely and can not come to campus, please email or call your University Service Desk for assistance:
  • Urbana, (217) 244-7000
  • System Offices (217) 333-3102
  • Springfield (217) 206-6000
  • Chicago (312) 413-0003 option 9

KeywordsMFA, 2FA, multi-factor 2-factor authentication, Two-factor authentication, Duo, Duo Security, Verify, UI Verify, enrollment, multi-factor, multifactor, security, AITS, token, yubikey, c100, register, claim, fob, key fob usb-c usb c   Doc ID72159
OwnerID M.GroupUniversity of Illinois Technology Services
Created2017-03-29 14:25 CDTUpdated2023-09-28 13:49 CDT
SitesUniversity of Illinois at Springfield, University of Illinois System, University of Illinois Technology Services
Feedback  4   3