gravitational/teleport · error

failed to open security keys

Error message

failed to open security keys

What it means

startDevices attempts to open every discovered FIDO2 device path; devices that fail to open are logged and skipped (common in multi-device scenarios where only the chosen device accepts the operation). This guard fires only when zero devices could be opened at all.

Source

Thrown at lib/auth/webauthncli/fido2.go:780

			// immediately followed by assertion (in a single process).
			// This is largely safe to ignore, as opening is fairly consistent in
			// other situations and failures are likely from a non-chosen device in
			// multi-device scenarios.
			fidoLog.DebugContext(context.Background(), "Device failed to open, skipping",
				"device", path,
				"error", err,
			)
			continue
		}

		fidoDevs = append(fidoDevs, dev)
		openDevs = append(openDevs, &openedDevice{
			path: path,
			dev:  dev,
		})
	}
	if len(fidoDevs) == 0 {
		return nil, nil, errors.New("failed to open security keys")
	}

	// Prompt touch, it's about to begin.
	ackTouch, err := prompt.PromptTouch()
	if err != nil {
		closeAll()
		return nil, nil, trace.Wrap(err)
	}
	//nolint:ineffassign // closeAll not meant to be used from here onwards.
	closeAll = nil

	errC := make(chan error, len(fidoDevs))
	devices = &openedDevices{
		devices: openDevs,
	}

	// Fire device handling goroutines.
	// From this point onwards devices are owned by their respective goroutines,

View on GitHub (pinned to 1283425b60)

Solutions

1. Unplug and reinsert the security key, then retry
2. Try a different USB port or cable
3. Check the key works with other FIDO2 clients (e.g. browser WebAuthn)
4. On Linux, verify udev permissions for the security key

When it happens

Trigger: Thrown at lib/auth/webauthncli/fido2.go:780 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/f0b22c53986b4bba. Report an issue: GitHub.