26

I am trying to log in to Github with Firefox. When I try to log in, the web page gives me an option to try with a passkey. When I do that, Firefox displays a dialog box saying "Touch your security key to continue with github.com." It does not offer any additional instructions about what that means or how to do that.

I'm not sure what I am supposed to do at this point. What is a "security key" and how do I touch it? Is a "security key" a separate physical device, or something else?

I have never set up any separate device (e.g., Yubikey etc.), so I am not sure what it is referring to. Any ideas how to interpret this message from Firefox? I am using Firefox 122.0.1. A websearch for "touch your security key to continue" turns up nothing useful.

D.W.
  • 1,851
  • 1
    What is do you run? On my windows boxen the passkeys are linked to windows hello and it may be a physical security key is the only option for your environment – Journeyman Geek Feb 17 '24 at 06:37
  • The source calls this message webauthn.userPresencePrompt. So this method is perhaps supposed to somehow verify the user's physical presence by your somehow interacting with something. Do you have a passkey or something? Do you use Firefox sync and how do you authenticate? – harrymc Feb 17 '24 at 10:01
  • 2
    @harrymc, thank you. I'm embarrassed to admit I don't know what a "passkey" is. I don't have a physical device. I don't think I use Firefox sync (at least not to my knowledge). – D.W. Feb 19 '24 at 05:20
  • If you don't have a passkey, why don't you login to github.com with the option of user-name & password? – harrymc Feb 19 '24 at 11:20
  • 1
    @harrymc, I do. After I enter username & password, Github prompts asking for a passkey ("When you are ready, authenticate using the button below. This browser or device is reporting partial passkey support." with a button for "Use passkey") I'm not familiar with passkeys and don't know how to interpret that. – D.W. Feb 19 '24 at 17:38
  • This link might jog your memory. – harrymc Feb 19 '24 at 17:43
  • You could install the bitwarden Extension. Then bitwarden offers to save the passkey (don't know how else one saves a passkey via firefox on linux ) – linuxistsuper Mar 04 '25 at 12:36
  • While this does not answer the question, it is possible to "get around" this by verifying with Github Mobile. – Aloha Churchill May 14 '25 at 22:09

3 Answers3

2

So, yeah.. the "Touch your security key" pop-up in Firefox when logging into GitHub is super confusing, especially if you never set up a YubiKey or anything. A security key can be a physical thing like a USB dongle (e.g. YubiKey), or you can use Windows Hello/fingerprint/PIN, or a passkey on your phone.

Since you say you didn’t set up a hardware key, sounds like GitHub’s trying to use a passkey you accidentally added somewhere else, or Firefox is just being dumb and not clear?

The easiest fix is to skip the passkey option and just use your GitHub username, password, and 2FA code (like from your phone app or text). Once you're logged in, check GitHub’s settings under Security > Passkeys to see if there’s a passkey registered. Delete it if you don’t have the device. If you want to use passkeys later, you can set one up with Windows Hello or your phone (Firefox might show a QR code to scan).

miken32
  • 580
PACKET TEL INC
  • 21
  • Thanks. For others who come across this, check for passkeys in Github by clicking 'Settings' from the menu from the icon at the upper-right, then selecting the 'Password and authentication' pane, then looking under "Sign in methods" for "Passkeys". – D.W. Aug 12 '25 at 03:47
  • For my specific situation, thanks, that was the problem! I did have a passkey registered. I'm not sure how it got there or how I created it, but it appeared associated with my mobile phone. I guess that was enough to trigger the message on my desktop machine. Anyway, I deleted the passkey on Github, and now the confusing message went away. (Yup, Firefox is updated; I'm currently using 140.0.64 on Fedora Linux.) Thank you! – D.W. Aug 12 '25 at 03:55
0

I'll just briefly state my experience:
On mobile, I can easily login to github using a passkey.

  • The key is saved in my password manager, Dashlane (it was easy to setup, this might be how the OP accidentally enabled this)
  • Android prompts me for my fingerprint when I attempt "Continue With Passkey"

On Firefox on my laptop:

  • Even though Dashlane syncs passwords to my plugin, it doesn't sync passkeys
  • The browser always reports "partial support" for passkeys
  • It always gave the same "Touch your security key to continue" prompt when trying "Continue with Passkey"
  • I ended up adding a passkey in my Github settings which Dashlane saved
  • Now when I click on "Continue with Passkey", Dashlane prompts me with the key it stored, however I have to enter my master password in order to use it, so it's not very convenient.
  • For Biometric unlock, Dashlane reports: "Your browser does not support biometrics."
user1718888
  • 101
  • 1
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Community Jan 02 '26 at 20:43
-11

As you might know, GitHub doesn't currently support login by username/password, so your only choice is to have some MFA.

enter image description here enter image description here enter image description here enter image description here

Ramhound
  • 44,829
  • 35
  • 116
  • 143
Anietie Akpan
  • 1
  • 7
    This does not really answer the author's question. Firefox itself cannot act like a Passkey device, extensions like 1Password and LastPass, if an supported extension is not present then a BT device must be present. – Ramhound Mar 28 '24 at 13:43
  • 1
    This answer is not helpful, as it explains an alternative method, which is explicitly not PassKey, but using the authenticator app with the TOTP method. – Nils Magnus Feb 11 '25 at 02:34