---
name: "fido2-token"
section: "1"
platform: "linux"
package: "libfido2"
version: "1.17.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fido2-token"
---

# fido2-token(1)

find and manage a FIDO2 authenticator

## NAME

**fido2-token** – find and manage a FIDO2 authenticator

## SYNOPSIS

**fido2-token** **-C** \[**-d**\] *device*

**fido2-token** **-D** \[**-d**\] **-i** *cred\_id* *device*

**fido2-token** **-D** **-b** \[**-d**\] **-k** *key\_path* *device*

**fido2-token** **-D** **-b** \[**-d**\] **-n** *rp\_id* \[**-i** *cred\_id*\] *device*

**fido2-token** **-D** **-e** \[**-d**\] **-i** *template\_id* *device*

**fido2-token** **-D** **-u** \[**-d**\] *device*

**fido2-token** **-G** **-b** \[**-d**\] **-k** *key\_path* *blob\_path* *device*

**fido2-token** **-G** **-b** \[**-d**\] **-n** *rp\_id* \[**-i** *cred\_id*\] *blob\_path* *device*

**fido2-token** **-G** **-t** *ppuat\_path* *device*

**fido2-token** **-I** \[**-cd**\] \[**-k** *rp\_id* **-i** *cred\_id*\] \[**-t** *ppuat\_path*\] *device*

**fido2-token** **-L** \[**-bder**\] \[**-k** *rp\_id*\] \[device\]

**fido2-token** **-R** \[**-d**\] *device*

**fido2-token** **-S** \[**-adefu**\] *device*

**fido2-token** **-S** \[**-d**\] **-i** *template\_id* **-n** *template\_name* *device*

**fido2-token** **-S** \[**-d**\] **-l** *pin\_length* *device*

**fido2-token** **-S** **-b** \[**-d**\] **-k** *key\_path* *blob\_path* *device*

**fido2-token** **-S** **-b** \[**-d**\] **-n** *rp\_id* \[**-i** *cred\_id*\] *blob\_path* *device*

**fido2-token** **-S** **-c** \[**-d**\] **-i** *cred\_id* **-k** *user\_id* **-n** *name* **-p** *display\_name* *device*

**fido2-token** **-S** **-m** *rp\_id* *device*

**fido2-token** **-V**

## DESCRIPTION

**fido2-token** manages a FIDO2 authenticator.

The options are as follows:

- **-C** *device*

  Changes the PIN of *device*. The user will be prompted for the current and new PINs.

- **-D** **-i** *id* *device*

  Deletes the resident credential specified by *id* from *device*, where *id* is the credential's base64-encoded id. The user will be prompted for the PIN.

- **-D** **-b** **-k** *key\_path* *device*

  Deletes a “largeBlob” encrypted with *key\_path* from *device*, where *key\_path* holds the blob's base64-encoded 32-byte AES-256 GCM encryption key. A PIN or equivalent user-verification gesture is required.

- **-D** **-b** **-n** *rp\_id* \[**-i** *cred\_id*\] *device*

  Deletes a “largeBlob” corresponding to *rp\_id* from *device*. If *rp\_id* has multiple credentials enrolled on *device*, the credential ID must be specified using **-i** *cred\_id*, where *cred\_id* is a base64-encoded blob. A PIN or equivalent user-verification gesture is required.

- **-D** **-e** **-i** *id* *device*

  Deletes the biometric enrollment specified by *id* from *device*, where *id* is the enrollment's template base64-encoded id. The user will be prompted for the PIN.

- **-D** **-u** *device*

  Disables the CTAP 2.1 “user verification always” feature on *device*.

- **-G** **-t** *ppuat\_path* *device*

  Retrieves a CTAP 2.2 persistent PIN/UV Auth token with read-only credential management permissions from *device* and writes it to *ppuat\_path*.

- **-G** **-b** **-k** *key\_path* *blob\_path* *device*

  Gets a CTAP 2.1 “largeBlob” encrypted with *key\_path* from *device*, where *key\_path* holds the blob's base64-encoded 32-byte AES-256 GCM encryption key. The blob is written to *blob\_path*.

- **-G** **-b** **-n** *rp\_id* \[**-i** *cred\_id*\] *blob\_path* *device*

  Gets a CTAP 2.1 “largeBlob” associated with *rp\_id* from *device*. If *rp\_id* has multiple credentials enrolled on *device*, the credential ID must be specified using **-i** *cred\_id*, where *cred\_id* is a base64-encoded blob. The blob is written to *blob\_path*. A PIN or equivalent user-verification gesture is required.

- **-I** *device* \[**-t** *ppuat\_path*\]

  Retrieves information on *device*. If **-t** *ppuat\_path* is given, **fido2-token** will attempt to use the CTAP 2.2 persistent PIN/UV Auth token stored in the file to decrypt encrypted device information.

- **-I** **-c** *device*

  Retrieves resident credential metadata from *device*. The user will be prompted for the PIN.

- **-I** **-k** *rp\_id* **-i** *cred\_id* *device*

  Prints the credential id (base64-encoded) and public key (PEM encoded) of the resident credential specified by *rp\_id* and *cred\_id*, where *rp\_id* is a UTF-8 relying party id, and *cred\_id* is a base64-encoded credential id. The user will be prompted for the PIN.

- **-L**

  Produces a list of authenticators found by the operating system.

- **-L** **-b** *device*

  Produces a list of CTAP 2.1 “largeBlobs” on *device*. A PIN or equivalent user-verification gesture is required.

- **-L** **-e** *device*

  Produces a list of biometric enrollments on *device*. The user will be prompted for the PIN.

- **-L** **-r** *device*

  Produces a list of relying parties with resident credentials on *device*. The user will be prompted for the PIN.

- **-L** **-k** *rp\_id* *device*

  Produces a list of resident credentials corresponding to relying party *rp\_id* on *device*. The user will be prompted for the PIN.

- **-R**

  Performs a reset on *device*. **fido2-token** will NOT prompt for confirmation.

- **-S**

  Sets the PIN of *device*. The user will be prompted for the PIN.

- **-S** **-a** *device*

  Enables CTAP 2.1 Enterprise Attestation on *device*.

- **-S** **-b** **-k** *key\_path* *blob\_path* *device*

  Sets a CTAP 2.1 “largeBlob” encrypted with *key\_path* on *device*, where *key\_path* holds the blob's base64-encoded 32-byte AES-256 GCM encryption key. The blob is read from *blob\_path*. A PIN or equivalent user-verification gesture is required.

- **-S** **-b** **-n** *rp\_id* \[**-i** *cred\_id*\] *blob\_path* *device*

  Sets a CTAP 2.1 “largeBlob” associated with *rp\_id* on *device*. The blob is read from *blob\_path*. If *rp\_id* has multiple credentials enrolled on *device*, the credential ID must be specified using **-i** *cred\_id*, where *cred\_id* is a base64-encoded blob. A PIN or equivalent user-verification gesture is required.

- **-S** **-c** **-i** *cred\_id* **-k** *user\_id* **-n** *name* **-p** *display\_name* *device*

  Sets the *name* and *display\_name* attributes of the resident credential identified by *cred\_id* and *user\_id*, where *name* and *display\_name* are UTF-8 strings and *cred\_id* and *user\_id* are base64-encoded blobs. A PIN or equivalent user-verification gesture is required.

- **-S** **-e** *device*

  Performs a new biometric enrollment on *device*. The user will be prompted for the PIN.

- **-S** **-e** **-i** *template\_id* **-n** *template\_name* *device*

  Sets the friendly name of the biometric enrollment specified by *template\_id* to *template\_name* on *device*, where *template\_id* is base64-encoded and *template\_name* is a UTF-8 string. The user will be prompted for the PIN.

- **-S** **-f** *device*

  Forces a PIN change on *device*. The user will be prompted for the PIN.

- **-S** **-l** *pin\_length* *device*

  Sets the minimum PIN length of *device* to *pin\_length*. The user will be prompted for the PIN.

- **-S** **-m** *rp\_id* *device*

  Sets the list of relying party IDs that are allowed to retrieve the minimum PIN length of *device*. Multiple IDs may be specified, separated by commas. The user will be prompted for the PIN.

- **-S** **-u** *device*

  Enables the CTAP 2.1 “user verification always” feature on *device*.

- **-V**

  Prints version information.

- **-d**

  Causes **fido2-token** to emit debugging output on *stderr*.

If a *tty* is available, **fido2-token** will use it to prompt for PINs. Otherwise, *stdin* is used.

**fido2-token** exits 0 on success and 1 on error.

## SEE ALSO

[fido2-assert(1)](/fido2-assert/1.md), [fido2-cred(1)](/fido2-cred/1.md)

## CAVEATS

The actual user-flow to perform a reset is outside the scope of the FIDO2 specification, and may therefore vary depending on the authenticator. Yubico authenticators do not allow resets after 5 seconds from power-up, and expect a reset to be confirmed by the user through touch within 30 seconds.

An authenticator's path may contain spaces.

Resident credentials are called “discoverable credentials” in CTAP 2.1.

Whether the CTAP 2.1 “user verification always” feature is activated or deactivated after an authenticator reset is vendor-specific.