What it is
Biometric security keys store fingerprint templates on the device itself. When a
service asks the key for user verification, the key can accept a
fingerprint touch in place of the PIN. keyroost manages these templates over the
standard CTAP2 authenticatorBioEnrollment command, so enrollments are
interoperable with any FIDO2 service.
Templates never leave the key. keyroost only sends enroll / rename / delete commands and reads back template IDs and names; the biometric data stays on the secure element.
Requirements
A Token2 key with a fingerprint sensor (the Fingerprints card only appears when the key reports biometric support), and a PIN set on the key — fingerprint management is PIN-gated. If no PIN is configured, set one first in the FIDO2 tab.
Enrolling
Open the FIDO2 tab and unlock with your PIN. In the Fingerprints card, start an enrollment and give it a name, then touch the sensor repeatedly as prompted — most keys need several touches from slightly different angles. A progress bar tracks captures; when complete, the new fingerprint appears in the list, where it can be renamed or deleted.
Command line
keyroostctl fido fingerprint-list --pin-env KR_PIN
keyroostctl fido fingerprint-enroll --pin-env KR_PIN --name "Right index"
keyroostctl fido fingerprint-rename --pin-env KR_PIN --template-id 0001 --name "Left index"
keyroostctl fido fingerprint-delete --pin-env KR_PIN --template-id 0002Troubleshooting
Timed out during enroll — touch the sensor when prompted; the key sends keep-alive frames while waiting and keyroost extends the timeout for the enrollment. A later op fails after a successful one — the key invalidates its verification token after some biometric writes; keyroost re-derives a fresh token per operation, so retry.