{"record":{"id":"1417a7e5a21e98ff","repo":"gravitational/teleport","slug":"you-are-using-a-security-key-that-is-not-registere","errorCode":null,"errorMessage":"you are using a security key that is not registered with Teleport - try a different security key","messagePattern":"you are using a security key that is not registered with Teleport - try a different security key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/auth/webauthncli/api.go","lineNumber":47,"sourceCode":"\t\"github.com/gravitational/teleport\"\n\t\"github.com/gravitational/teleport/api/client/proto\"\n\t\"github.com/gravitational/teleport/api/observability/tracing\"\n\t\"github.com/gravitational/teleport/lib/auth/touchid\"\n\twantypes \"github.com/gravitational/teleport/lib/auth/webauthntypes\"\n\twanwin \"github.com/gravitational/teleport/lib/auth/webauthnwin\"\n\tlogutils \"github.com/gravitational/teleport/lib/utils/log\"\n)\n\nvar (\n\tlog     = logutils.NewPackageLogger(teleport.ComponentKey, \"WebAuthn\")\n\tfidoLog = logutils.NewPackageLogger(teleport.ComponentKey, \"FIDO2\")\n)\n\n// ErrUsingNonRegisteredDevice is returned from Login when the user attempts to\n// authenticate with a non-registered security key.\n// The error message is meant to be displayed to end-users, thus it breaks the\n// usual Go error conventions (capitalized sentences, punctuation).\nvar ErrUsingNonRegisteredDevice = errors.New(\"you are using a security key that is not registered with Teleport - try a different security key\")\n\n// AuthenticatorAttachment allows callers to choose a specific attachment.\ntype AuthenticatorAttachment int\n\nconst (\n\tAttachmentAuto AuthenticatorAttachment = iota\n\tAttachmentCrossPlatform\n\tAttachmentPlatform\n)\n\nfunc (a AuthenticatorAttachment) String() string {\n\tswitch a {\n\tcase AttachmentAuto:\n\t\treturn \"auto\"\n\tcase AttachmentCrossPlatform:\n\t\treturn \"cross-platform\"\n\tcase AttachmentPlatform:\n\t\treturn \"platform\"","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/api.go#L29-L65","documentation":"ErrUsingNonRegisteredDevice is returned from Login (and surfaced via fido2.go:252) when the user taps a security key that holds no valid registration for this RelyingParty. Its message is deliberately end-user facing (lowercase-style sentence addressed to the operator of the key), so it breaks Go error conventions on purpose.","triggerScenarios":"webauthncli.Login/FIDO2Login where the tapped authenticator returns no valid assertion for the rpID/allowCredentials — e.g. the key is registered to a different site or RPID, or not registered at all.","commonSituations":"User owns several YubiKeys and plugs the wrong one; key registered to a different Teleport cluster; RPID or origin changed so existing registrations no longer match; first-time user tapping an unregistered key.","solutions":["Insert and tap a security key that is registered with this Teleport cluster (tsh mfa add to register a new one).","Run tsh mfa ls (or check the Web UI) to confirm which devices are registered for your user.","Register the plugged key: tsh mfa add --type=webauthn.","If the key should be valid, verify the cluster's WebAuthn RPID matches the one used at registration time."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// check registered MFA devices before attempting login\ntsh mfa ls","typeGuard":null,"tryCatchPattern":"resp, user, err := wancli.Login(ctx, origin, assertion, prompt, opts)\nif errors.Is(err, wancli.ErrUsingNonRegisteredDevice) {\n\tfmt.Fprintln(os.Stderr, wancli.ErrUsingNonRegisteredDevice.Error()) // show the user-facing hint\n}","preventionTips":["Keep registered security keys labeled and identified (tsh mfa ls).","Register a spare key before attempting passwordless/MFA login.","Avoid changing cluster RPID, which invalidates existing key registrations.","Show the error's user-facing message verbatim to end users — it is designed for them."],"tags":["webauthn","fido2","security-key","not-registered"],"backgroundTag":"authenticator-not-registered","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}