gravitational/teleport · error

no security keys found

Error message

no security keys found

What it means

RunOnFIDO2Devices enumerates FIDO2 device locations via fidoDeviceLocations() and this guard fires when the list is empty, meaning no security keys (or platform authenticators) are visible to the host before any prompt is shown.

Source

Thrown at lib/auth/webauthncli/fido2.go:680

	pinAwareCallbackFunc func(dev FIDODevice, info *deviceInfo, pin string) (requiresPIN bool, err error)
)

// runPrompt defines the prompt operations necessary for runOnFIDO2Devices.
// (RegisterPrompt happens to match the minimal interface required.)
type runPrompt RegisterPrompt

func runOnFIDO2Devices(
	ctx context.Context,
	prompt runPrompt,
	filter deviceFilterFunc,
	deviceCallback deviceCallbackFunc,
) error {
	locs, err := fidoDeviceLocations()
	if err != nil {
		return trace.Wrap(err, "device locations")
	}
	if len(locs) == 0 {
		return trace.Wrap(errors.New("no security keys found"))
	}

	devices, devicesC, err := startDevices(locs, filter, deviceCallback, prompt)
	if err != nil {
		return trace.Wrap(err)
	}

	var receiveCount int
	defer func() {
		// Cancel all in-flight requests, if any.
		devices.cancelAll(nil /* except */)

		// Give the devices some time to tidy up, but don't wait forever.
		maxWait := time.NewTimer(fido2DeviceMaxWait)
		defer maxWait.Stop()

		for receiveCount < devices.len() {
			select {

View on GitHub (pinned to 1283425b60)

Solutions

1. Plug in a FIDO2 security key and retry
2. Check the key is visible to the OS (lsusb on Linux, or the browser/OS authenticator settings)
3. On Linux, verify udev rules for the security key are installed so the device is accessible

When it happens

Trigger: Thrown at lib/auth/webauthncli/fido2.go:680 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/22d11e0f728aa851. Report an issue: GitHub.