# Use a security key with PhantomVault

> Create or open a vault with a compatible physical key, and keep app-access keys separate.

Document ID: phantom-help:phantomvault/security-keys
Product: PhantomVault
Platforms: macOS and iOS
Updated: 2026-11-02
Availability: Preview-build instructions.
Tested app version: Not recorded
Tested build: Not recorded
Tested OS version: Not recorded

Source: https://llms.phantomsecure.app/phantomvault/security-keys.md
Human guide: https://phantomsecure.app/help/phantomvault/security-keys/
Agent guide: https://llms.phantomsecure.app/phantomvault/security-keys/
Documentation index: https://phantomsecure.app/llms.txt
Full handbook: https://phantomsecure.app/llms-full.txt

## Check compatibility first

Vault security-key support uses a compatible FIDO2 key with the required PRF capability. Not every device sold as a security key supports this use. The Mac interface labels its vault-key feature a prototype. Keep another copy of files you cannot afford to lose before relying on a newly configured key.

The current vault feature enrolls one key. It cannot add spare vault keys or replace a lost or reset enrolled credential. A security-key vault has no fallback vault passphrase.

## Create a security-key vault on Mac

1. Start **New Vault** and continue to **Unlock Your Vault**.
2. Choose **Security Key** under **Unlock With**.
3. Read and select the acknowledgment that the key is required and recovery is unavailable.
4. Choose any **Additional Protection**, finish the remaining fields, and choose **Create Vault**.
5. Connect the compatible USB key and complete its PIN and touch prompts when requested.

Do not enter the PhantomCal PIN, Mac login password or app password in place of a key's own PIN. Cancelling a prompt cancels that attempt.

## Create a security-key vault on iPhone or iPad

1. In **Create Vault**, set **Unlock with** to **Security Key**.
2. Choose any **Require iCloud Keychain** option and your **Save Location**.
3. Tap **Create**.
4. Follow Apple's security-key sheet for connection, touch and any PIN. The system handles the available USB or NFC interaction.

Selecting **Security Key** alone does not register the key. Registration and a separate confirmation happen during creation.

## Open it again

On Mac, select the vault and complete the security-key prompt. On iPhone or iPad, select the vault and tap **Use Security Key**, then finish Apple's prompts. Use the same registered key. Optional custody and current synchronized key state must also be available.

If a different key or unsupported key is rejected, reconnect the registered compatible key and retry. If the registered key has been lost or reset, a second unregistered key cannot recover the vault. Preserve your encrypted copies while checking any other device that already has legitimate access.

## App Access keys are a different feature

Mac **Settings → App Access → Security Keys → Add Key** registers a key to unlock the app interface. That feature can list multiple named app keys. It does not enroll those keys into your vaults. See [App Access](https://phantomsecure.app/help/phantomvault/app-access.md).