---
title: FIDO2 Security Key Auth
description: Set up Omarchy FIDO2 authentication for sudo, polkit, and Hyprlock with touch-first daily prompts.
sidebar:
  order: 2
---

This setup uses a FIDO2 security key through `pam-u2f`. The key becomes the preferred local authentication path for `sudo`, polkit prompts, and Hyprlock, while the account password stays available as fallback.

The daily path is touch-only. Do not add `pinverification=1` unless you want the security-key PIN on every `sudo`, `pkexec`, and Hyprlock authentication.

It does not change LUKS disk decryption. Boot still uses the LUKS passphrase unless a separate LUKS token setup is configured.

:::caution[Keep a fallback]
Keep an unlocked terminal open while editing PAM files. Do not remove the password fallback unless you have a separate recovery path.
:::

## Start with the Omarchy menu

Use Omarchy's built-in FIDO2 setup first:

1. Open the Omarchy menu.
2. Go to **Setup**.
3. Go to **Security**.
4. Choose **Fido2**.
5. Touch the security key when prompted.
6. Let the script test `sudo` before closing the terminal.


The setup installs `libfido2` and `pam-u2f`, registers the key with `pamu2fcfg`, stores the mapping at `/etc/fido2/fido2`, and adds `pam_u2f.so` to `sudo` and `polkit-1`.

The default Omarchy setup is touch-based. Keep that behaviour for daily use, then add Hyprlock manually.

## Confirm sudo and polkit

Use this touch-only line in `/etc/pam.d/sudo` and `/etc/pam.d/polkit-1`:

```text
auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] authfile=/etc/fido2/fido2
```

Keep the existing password lines below it. With `sufficient`, a successful security-key auth skips the password prompt; failure falls through to the password fallback.

## Add Hyprlock

The Omarchy shell lock screen uses its own PAM service. Omarchy's FIDO2 setup does not add this line automatically, so prepend it to `/etc/pam.d/omarchy-lock-password`:

```text
auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] authfile=/etc/fido2/fido2
```

Leave the default password stack below it so normal password unlock still works. The packaged lock-screen prompt is owned by Omarchy 4 and is not configured through a stowed `hyprlock.conf`.

## Remove fingerprint leftovers

If Omarchy's fingerprint setup was run by mistake, remove its PAM lines and packages:

```bash
pkexec sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo /etc/pam.d/polkit-1
pkexec pacman -Rns fprintd libfprint-git
```

The Omarchy shell detects fingerprint support through its separate `omarchy-lock-fingerprint` PAM service.

## PIN mode

`pinverification=1` is stricter, but `pam-u2f` prompts for the security-key PIN on every PAM authentication. It does not cache the PIN for the whole login session.

Use PIN mode only if that tradeoff is intentional:

```text
auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] pinverification=1 authfile=/etc/fido2/fido2
```

## Test order

Test each layer before relying on it:

1. Run `sudo -k`, then `sudo true`.
2. Touch the security key when prompted.
3. Trigger a polkit prompt if convenient.
4. Lock the screen with the Omarchy shell while another session or terminal remains available.
5. Test password fallback by trying without the security key.


## Rollback

Restore the backed-up PAM files, or remove only the added `pam_u2f.so` line from `/etc/pam.d/omarchy-lock-password` if the lock screen is the only broken part.

Do not delete `/etc/fido2/fido2` unless you are fully removing FIDO2 auth.