Yubico OTP is a simple yet strong authentication mechanism thatis supported by all YubiKeys out of the box. Yubico OTP can be used as the secondfactor in a 2-factor authentication scheme or on its own, providing 1-factorauthentication.
The most common pattern is to use Yubico OTP in combination with a username and password:
YubiCloud
YubiCloud is the name of Yubico’s web service for verifying OTPs. Before using YubiCloud, you need to get an API key from here — it’s quick, free and helps us preventing misuse of YubiCloud.
If you prefer to not use YubiCloud, you can instead host a verification server yourself.
Advantages
Apart from the general advantages of 2-factor authentication, Yubico OTP has the following characteristics:
No client software needed. The OTP is just a string. If you can send a password, you can send an OTP.
YubiKey ID embedded in OTP. This allows for self-provisioning, as well as authenticating without a username.
See AlsoA Yubico FAQ about passkeysEasy to implement. Using YubiCloud, supporting Yubico OTP is not much harder than supporting regular passwords.
One api.yubico.com One HTTP GET
In 2020, Yubico consolidated all YubiOTP validation API servers behind a single endpoint: api.yubico.com. This modernized, cloud-based service enhances reliability and scalability. Customers now need only to make a single HTTP GET request to api.yubico.com for OTP validation.
To optimize performance, domain names pointing to this service are geolocated, directing YubiCloud clients to the nearest endpoint. We recommend configuring your clients to use api.yubico.com if you haven’t already done so.
Please note that Yubico’s legacy client libraries in PHP, C, .NET, Perl, and Java on GitHub are archived and will not be updated to support the new endpoint. These libraries previously handled multiple YubiCloud endpoints, a function now obsolete. Directly implementing the HTTP GET call in client applications removes the dependency on third-party libraries.
For detailed guidance on generating and verifying signatures and constructing HTTP GET calls for OTP verification, refer to the Yubico OTP Validation Protocol Version 2.0.
Implementing
We provide two alternatives:
Integration plugins for software such as Wordpress, phpBB and PAM. This should be the easiest alternative if you are using supported software.
Libraries for programming languages used to create your own integration.
Understanding
While not required, it can be interesting and useful to know how a Yubico OTP is generated. Thisis explained in OTPs explained.
