> For the complete documentation index, see [llms.txt](https://docs.k9.io/key9-identity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.k9.io/key9-identity/ssh/installation-and-setup/openssh-with-yubikey-fido2-protected-keys/2.-openssh-command-for-yubkey-fido2.md).

# 2. OpenSSH command for Yubkey FIDO2

FIDO2 (with ed25519-sk) is a simple way to protect your keys and is simple to enroll.    Unfortunately,  not all Yubikeys support FIDO2.   In that case, you might be able to use your Yubikey like a "Smartcard" (PIV).   Yubikey/Smartcard takes more steps but is not that difficult.  Please see:

MacOS:   <https://docs.k9.io/key9-documentation/macos-yubikey-smartcard-piv-instructions.>

Windows: <https://docs.k9.io/key9-documentation/windows-yubikey-smartcard-piv-instructions>

First, make sure your Yubikey is PIN-protected.   If it is not PIN protected,  do that first:

{% embed url="<https://docs.k9.io/key9-documentation/setting-a-yubikey-pin-without-yubikey-software>." %}

&#x20;If your Yubikey is PIN-protected,  run the following command to sign a new private key with your Yubikey.  &#x20;

`$ ssh-keygen -t ed25519-sk -O resident -O verify-required -O application=ssh:key9.dev`