Oct 25, 2026

Which AI Assistants Support YubiKeys and Passkeys? (2026)

ChatGPT is the only assistant from an AI-only company that lets you put a YubiKey on the account itself, and it has a mode that accepts nothing else. Gemini, Microsoft Copilot and Meta AI take a YubiKey through the Google, Microsoft or Meta account you already have. Claude and Perplexity have no passkey or security key setting: you sign in with Google, Apple, company SSO or an emailed link, so the key goes on that account instead. Grok has its own two-factor setting but doesn’t say whether it takes security keys.

The table

Checked October 25, 2026, against each maker’s help docs and the parent account’s (Google, Microsoft, Meta, X). Where a vendor doesn’t document something, the table says so instead of guessing.

Assistant	You sign in with	YubiKey or passkey?	Where the key goes
ChatGPT	An OpenAI account	Yes, built in. Passkeys, which can live on a YubiKey, plus Advanced Account Security, a keys-only mode	ChatGPT → Settings → Security
Gemini	Your Google account	Yes, through Google. Security keys, passkeys and Advanced Protection	Google Account → Security
Microsoft Copilot	A Microsoft account, or your work account	Yes, through Microsoft. Passkeys and FIDO2 security keys	Microsoft account → Security → Advanced security options
Meta AI	Your Meta account	Yes, through Meta. Security keys for two-factor, and passkeys on Facebook, Messenger and Instagram	Accounts Center → Password and security
Grok	An xAI account, opened with X, Google, Apple or email	Through X, Google or Apple. xAI has its own MFA but doesn’t publish which methods it takes	X, Google or Apple, plus accounts.x.ai → Security
Claude	Google, or an emailed sign-in link	Not on the Claude account. Only through Google	Your Google account
Perplexity	Google, Apple, company SSO, or an emailed link	Not on the Perplexity account. Only through Google, Apple or SSO	Your Google, Apple or SSO account

OpenAI and Anthropic now require keys for their strongest models

Both labs have stopped trusting passwords and text codes for their most capable cyber models.

OpenAI, from September 1, 2026: individual members of its Trusted Access for Cyber program must turn on Advanced Account Security with a hardware-backed passkey to keep access (Yubico’s write-up).
Anthropic, by December 15, 2026: individuals in its Cyber Verification Program must sign in “only through Google or an equivalent identity provider” and protect that account with a security key, passkey or smartcard. Email-link sign-in has to be off, and SMS, emailed codes, authenticator-app codes and push approvals don’t count (the requirements).

The two labs took different routes. OpenAI put the key on its own account. Anthropic sends you to Google and puts the key there.

ChatGPT: keys on the OpenAI account itself

Under Settings → Security → Passkeys you can add a passkey, including one stored on a YubiKey. Two-factor options also include an authenticator app, push approval and SMS or WhatsApp codes (OpenAI’s MFA page).

Advanced Account Security goes further. It turns off your password, sign-in codes and email recovery, and leaves passkeys and security keys as the only way in. OpenAI and Yubico sell a two-key bundle for it. Setup, the bundle and the recovery trade-offs are in ChatGPT Advanced Account Security, explained.

Gemini and Copilot: the key goes on Google or Microsoft

Gemini is your Google account. Add a YubiKey under Google Account → Security → 2-Step Verification → Security keys, or save a passkey to it. A newly added key can take up to 7 days to work at sign-in (Google’s security key page). Google’s Advanced Protection Program goes further: it requires a passkey or security key to sign in, and only lets Google apps and verified third-party apps reach your Google data.

Microsoft Copilot on a personal Microsoft account takes passkeys and FIDO2 security keys. Go to account.microsoft.com → Security → Advanced security options and add a new way to sign in. On Microsoft 365 Copilot at work, your IT admin decides, and Entra ID can require passkeys on a hardware key.

Meta AI: one Meta account for every app

Meta’s account now manages the password and two-factor settings for Facebook, Instagram, Messenger, Threads, Meta AI and Meta’s AI glasses in one place (Meta’s announcement). A YubiKey works as a two-factor security key, and passkeys work on Facebook, Messenger and Instagram. Security keys don’t work in every browser, so keep a second method on file.

Claude and Perplexity: your Google account is the lock

Claude signs you in with Google or with a link and code sent to your email. There’s no passkey or security key setting on the Claude account. A request for passkey sign-in has been open on Anthropic’s GitHub since August 7, 2026. Anthropic’s own cyber-program rules point to the setup to copy: sign in with Google and put the YubiKey on Google.

Perplexity offers four ways in, all passwordless: Google, Apple, company SSO, or a magic link and one-time code sent to your inbox (Perplexity’s sign-in help). Any MFA happens at the provider.

Either way, an emailed sign-in link means whoever can read your email can sign in as you. The key belongs on your email account.

Grok: depends how you signed up

Grok runs on an xAI account, which is separate from your X account. You open it with X, Google, Apple or an email address. xAI recommends adding MFA on the accounts.x.ai Security page and saving recovery codes, because it can’t reset MFA without them. It doesn’t say which MFA methods it accepts. If you sign in with X, X takes security keys for two-factor and supports passkeys. If you sign in with Google or Apple, both take security keys.

The account you chat in now reaches your email

AI assistants used to hold chat history. Now they connect to your email, calendar and files, and act on them.

Carly plugs into ChatGPT, Claude, Grok Bot, Meta Muse and Perplexity, so you get email labeling and sorting, advanced calendar work, and phone and SMS inside the AI you already chat with. It follows your rules the same way every time and connects to thousands of apps. In Claude, click Get the Carly connector, then Connect, and sign in. In ChatGPT, click Get the Carly plugin, add it, and sign in with your Carly account.

That makes the sign-in worth locking down. Two keys cover it:

On the account you sign in to the assistant with. That’s your OpenAI account for ChatGPT and your Google account for Claude or Gemini.
On the Google or Microsoft account behind your inbox. One YubiKey holds passkeys for many accounts, so the same pair covers both. Buy two, and keep one as a backup.

FAQ

Does Claude support YubiKeys?

Not on the Claude account itself. Claude signs you in with Google or an emailed link, so put the YubiKey on your Google account and sign in to Claude with Google.

Does Gemini support passkeys and security keys?

Yes, through your Google account. Add a security key or passkey in your Google Account security settings, or join Google’s Advanced Protection Program to require one.

Can I use one YubiKey for ChatGPT, Google and Microsoft?

Yes. A YubiKey stores passkeys for many accounts. Register two keys on each account so losing one doesn’t lock you out.

ChatGPT with Advanced Account Security and Gemini with Google’s Advanced Protection both accept only passkeys and security keys. Claude gets the same protection if you sign in with a Google account that has Advanced Protection on.

Does Perplexity have passkeys or security keys?

Not as a Perplexity setting. Perplexity signs you in through Google, Apple, company SSO or an emailed link, so the key goes on that account.

Ready to automate your busywork?

Carly schedules, researches, and briefs you—so you can focus on what matters.

See what people say

"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.

Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.

On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."

Gus Ibrahim, Founder & Director, IHR