Hardware security key
A physical USB or NFC key you tap at login, proving the real device is present without giving a phishable code to type.
See it
What it is
A hardware security key is a physical authenticator, such as a YubiKey, that stores private keys and signs login challenges over USB, NFC, or Bluetooth. In a WebAuthn flow the site stores only the public key, and touching the device proves that the key is physically present. A key with a PIN or biometric can also verify the person using it.
Reach for one when accounts need phishing-resistant MFA without relying on a phone, especially for administrators, developers, journalists, and people likely to be targeted. Unlike a TOTP code, its signature is bound to the real site, so a fake login page cannot relay something the attacker can reuse. Google moved its own staff, more than 85,000 people, onto security keys in 2017 and reported no successful phishing of work accounts afterwards.
The gotcha is recovery: a device-bound key does not magically reappear after it is lost or broken. Register at least two keys, keep the spare somewhere separate, and provide carefully controlled recovery. Also do not confuse user presence with user verification. A tap proves someone has the key; requiring its PIN or biometric adds proof that the key verified its user.
Ask AI for it
Add hardware security key enrollment and sign-in with WebAuthn using @simplewebauthn/server and @simplewebauthn/browser. During registration set authenticatorAttachment to 'cross-platform', use attestation 'none', exclude credential IDs already registered to the account, and store credential ID, public key, counter, transports, and a user-editable device name. During sign-in verify the server challenge, expected origin, RP ID hash, signature, user-present flag, and the configured userVerification requirement. Let each account register at least two keys, refuse to delete its last usable authentication method, show last-used timestamps, and require a fresh WebAuthn assertion before removing a key.