Check compatibility first
Vault security-key support uses a compatible FIDO2 key with the required PRF capability. Not every device sold as a security key supports this use. The Mac interface labels its vault-key feature a prototype. Keep another copy of files you cannot afford to lose before relying on a newly configured key.
The current vault feature enrolls one key. It cannot add spare vault keys or replace a lost or reset enrolled credential. A security-key vault has no fallback vault passphrase.
Create a security-key vault on Mac
- Start New Vault and continue to Unlock Your Vault.
- Choose Security Key under Unlock With.
- Read and select the acknowledgment that the key is required and recovery is unavailable.
- Choose any Additional Protection, finish the remaining fields, and choose Create Vault.
- Connect the compatible USB key and complete its PIN and touch prompts when requested.
Do not enter the PhantomCal PIN, Mac login password or app password in place of a key's own PIN. Cancelling a prompt cancels that attempt.
Create a security-key vault on iPhone or iPad
- In Create Vault, set Unlock with to Security Key.
- Choose any Require iCloud Keychain option and your Save Location.
- Tap Create.
- Follow Apple's security-key sheet for connection, touch and any PIN. The system handles the available USB or NFC interaction.
Selecting Security Key alone does not register the key. Registration and a separate confirmation happen during creation.
Open it again
On Mac, select the vault and complete the security-key prompt. On iPhone or iPad, select the vault and tap Use Security Key, then finish Apple's prompts. Use the same registered key. Optional custody and current synchronized key state must also be available.
If a different key or unsupported key is rejected, reconnect the registered compatible key and retry. If the registered key has been lost or reset, a second unregistered key cannot recover the vault. Preserve your encrypted copies while checking any other device that already has legitimate access.
App Access keys are a different feature
Mac Settings → App Access → Security Keys → Add Key registers a key to unlock the app interface. That feature can list multiple named app keys. It does not enroll those keys into your vaults. See App Access.