A security key setup checklist should confirm service and device compatibility, enroll the key only from the official account settings, add an independent backup method, and test sign-in before ending the old session. Plan for loss before making a physical key the only route into an important account.
Check compatibility and choose the role
Decide whether the key will be used as a second factor, as a passkey, or within a high-security account program. Confirm the service, browsers, operating systems, connector type, and mobile-device support. Google notes that a key used to create a passkey must support FIDO2, while FIDO1 or FIDO2 keys can serve as a second step for Google two-step verification. See Google's security-key guide.
Buy from a source you trust and inspect the package. Do not plug in an unsolicited key or one found in public. Give each key a neutral label that distinguishes it from the backup without printing the account name, email address, or PIN on the device.
Prepare recovery before enrollment
Verify the recovery email and phone, create provider-supported backup codes when appropriate, and identify a second authenticator. Google recommends adding more ways to prove identity if a key is lost and describes removing a lost key through another trusted sign-in method. A spare key stored securely can reduce the risk of a single physical failure becoming an account lockout.
CISA recommends phishing-resistant MFA and identifies physical security keys as a strong option. Its MFA guidance for organizations ranks security keys above weaker code-based choices. Recovery methods still matter, so review whether an easier fallback would undermine the protection you expect.
Enroll from the official settings
Open the account's security page directly, confirm the correct account, and choose the provider's add-key flow. Insert or tap the key only when the trusted page requests it. Set a PIN if the key or service requires one, but never write that PIN on the key. Name the credential clearly in the account list and record the enrollment date without copying secret material.
Enroll the backup key separately and verify that both appear in the account's authentication list. A newly added key may have a provider-specific waiting period before every use is available, so read the confirmation screen and avoid removing the prior working factor too early.
Test and store the keys
Sign out of a noncritical session and test the primary key in a supported browser. Then test the backup method. Confirm how the account behaves on a phone or device without the same connector. Do not disable all other working factors until the intended login and recovery paths have succeeded.
Store the spare key away from the primary key and everyday device. Document how to revoke a missing key and who is authorized to make that change. Review the credential list periodically and remove keys you do not recognize. If a key is lost, use a trusted method to sign in, remove the lost credential promptly, and replace it. The setup is complete only when routine sign-in and recovery both work without exposing a PIN or backup code.
Sources
- Use a security key for 2-Step Verification — Google
- Require Multifactor Authentication — Cybersecurity and Infrastructure Security Agency