By Dana Whitfield, a fictional AI editorial persona. This AI-generated guide draws on the linked sources; it is not a hands-on test or human expert review.
A security key listing can look straightforward: a connector, a few protocol names, and a photograph. For a small business, the useful question is more specific: will this exact key work with the accounts, computers, and phones your team actually uses?
This guide explains how to build a compatibility checklist before making a purchasing decision. It does not rank products, certify a business setup, or promise protection. The worksheet below is an editorial planning method, not a substitute for your account provider’s instructions or your administrator’s policies.
Start with an account list, not a product list
Write down the services where you want to use a key. Keep the list concrete: the company email account, the project-management service, or the accounting platform. Beside each, record whether it is a personally managed account or a work account managed by an administrator.
Then find that provider’s current help page for hardware keys. Record the supported sign-in method in the provider’s own terms. Do not turn a general statement that a service supports passkeys into a conclusion about every key, every application, or every company account.
Separate the connector from the sign-in method
Yubico’s technical manual identifies Security Key Series models with USB-A plus NFC and USB-C plus NFC. It also describes other form factors, so the exact product name matters. This is a documented hardware distinction, not a recommendation for either model. Source: Yubico physical attributes.
Google documents a separate distinction: creating a passkey on a hardware key requires FIDO2, while its second-step verification accepts FIDO1 or FIDO2 keys. These are Google-specific requirements, not a rule for every business service. Source: Google security-key help.
Keep two separate columns in your notes: physical connection and provider-supported use. A connector that fits is only one item to verify. Equally, a supported sign-in protocol does not tell you which port is on the employee’s laptop.
Map the actual devices
For each intended user, record the computer model, available ports, phone model, operating system, and browser. Include the browser used for work, rather than whichever browser happens to be installed. If the person uses a native mobile app, list it separately from the website.
Yubico publishes an iOS and iPadOS compatibility table that distinguishes browser-based use from apps using its mobile SDK. That distinction illustrates why a phone’s name alone is not a complete compatibility check. Consult the relevant table for your precise setup rather than assuming all mobile sign-in paths behave alike. Source: Yubico mobile compatibility.
A worksheet you can copy
- Account and account type: Which service and which organization?
- Required use: A second sign-in step, a passkey, or another documented method?
- Candidate key: Exact model, connector, and relevant product documentation.
- Device route: Computer or phone, operating system, browser or app.
- Administrator check: Who can confirm the organization’s permitted methods?
- Open question: What still needs confirmation before purchase or rollout?
Use “not yet verified” rather than a blank cell. A blank can quietly become an assumption when the worksheet is forwarded to someone else. Record the help-page link and the date you checked it so another person can retrace your reasoning.
A hypothetical three-person example
Imagine a design studio with two USB-C laptops, one older desktop, and three different phones. The owner starts with one candidate model because it looks convenient. The worksheet reveals that the desktop connection and one mobile app remain unverified.
The next step is to resolve those two questions with current documentation or the service administrator. The studio has not established compatibility merely by counting three employees and selecting three keys. This is a fictional planning example, not a report of a deployment or a finding about a particular product.
Keep the rollout questions separate
Before changing a work account, ask its administrator how enrollment, replacement, and account recovery are handled. Google, for example, directs users to add other ways to establish identity in case a key is lost. Follow the rules of the actual provider and organization; do not copy another service’s recovery process into your business policy. Source: Google security-key help.
A useful compatibility worksheet ends with a small set of verified matches and clearly named unknowns. That is more actionable than a broad “works everywhere” label, and it gives your administrator a focused set of questions to answer before any change.
Source pages checked October 30, 2026. Product specifications and software interfaces can change. Links in this article are informational, not affiliate links.