you are using a security key that is not registered with Tel

Error message

you are using a security key that is not registered with Teleport - try a different security key

What it means

ErrUsingNonRegisteredDevice is returned from Login (and surfaced via fido2.go:252) when the user taps a security key that holds no valid registration for this RelyingParty. Its message is deliberately end-user facing (lowercase-style sentence addressed to the operator of the key), so it breaks Go error conventions on purpose.

Source

Thrown at lib/auth/webauthncli/api.go:47

	"github.com/gravitational/teleport"
	"github.com/gravitational/teleport/api/client/proto"
	"github.com/gravitational/teleport/api/observability/tracing"
	"github.com/gravitational/teleport/lib/auth/touchid"
	wantypes "github.com/gravitational/teleport/lib/auth/webauthntypes"
	wanwin "github.com/gravitational/teleport/lib/auth/webauthnwin"
	logutils "github.com/gravitational/teleport/lib/utils/log"
)

var (
	log     = logutils.NewPackageLogger(teleport.ComponentKey, "WebAuthn")
	fidoLog = logutils.NewPackageLogger(teleport.ComponentKey, "FIDO2")
)

// ErrUsingNonRegisteredDevice is returned from Login when the user attempts to
// authenticate with a non-registered security key.
// The error message is meant to be displayed to end-users, thus it breaks the
// usual Go error conventions (capitalized sentences, punctuation).
var ErrUsingNonRegisteredDevice = errors.New("you are using a security key that is not registered with Teleport - try a different security key")

// AuthenticatorAttachment allows callers to choose a specific attachment.
type AuthenticatorAttachment int

const (
	AttachmentAuto AuthenticatorAttachment = iota
	AttachmentCrossPlatform
	AttachmentPlatform
)

func (a AuthenticatorAttachment) String() string {
	switch a {
	case AttachmentAuto:
		return "auto"
	case AttachmentCrossPlatform:
		return "cross-platform"
	case AttachmentPlatform:
		return "platform"

View on GitHub (pinned to 1283425b60)

Solutions

Insert and tap a security key that is registered with this Teleport cluster (tsh mfa add to register a new one).
Run tsh mfa ls (or check the Web UI) to confirm which devices are registered for your user.
Register the plugged key: tsh mfa add --type=webauthn.
If the key should be valid, verify the cluster's WebAuthn RPID matches the one used at registration time.

Defensive patterns

Strategy: try-catch

Validate before calling

// check registered MFA devices before attempting login
tsh mfa ls

Try / catch

resp, user, err := wancli.Login(ctx, origin, assertion, prompt, opts)
if errors.Is(err, wancli.ErrUsingNonRegisteredDevice) {
	fmt.Fprintln(os.Stderr, wancli.ErrUsingNonRegisteredDevice.Error()) // show the user-facing hint
}

Prevention

Keep registered security keys labeled and identified (tsh mfa ls).
Register a spare key before attempting passwordless/MFA login.
Avoid changing cluster RPID, which invalidates existing key registrations.
Show the error's user-facing message verbatim to end users — it is designed for them.

When it happens

Trigger: webauthncli.Login/FIDO2Login where the tapped authenticator returns no valid assertion for the rpID/allowCredentials — e.g. the key is registered to a different site or RPID, or not registered at all.

Common situations: User owns several YubiKeys and plugs the wrong one; key registered to a different Teleport cluster; RPID or origin changed so existing registrations no longer match; first-time user tapping an unregistered key.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/1417a7e5a21e98ff. Report an issue: GitHub.