# 2FA with Token2 **URL:** \ **Category:** Help\ **Created:** [November 13, 2025, 3:15pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889 "2025-11-13T15:15:23Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 13, 2025, 3:15pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/1 "2025-11-13T15:15:23Z")
Hello, i want to add an Token2 Hardwarekey to my Vaultwarden, but everytime i want to read the key i get the same error. First it says to click the button from the key and then without doing anything i get the error. Key is working well with nextcloud and [webauthn.io](http://webauthn.io) ![Screenshot 2025-11-13 161316](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/b/b983e1b545fb9d567c948a8e14c9e2097134bd62.png) ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 9:44am UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/2 "2025-11-14T09:44:33Z")
Hello. 1. Does the key have a PIN set? 2. Can you try with the web Bitwarden \> [Token2 | Using Bitwarden Passkey functionality with Token2 FIDO2 Security Keys | Token2 Store | programmable hardware token, FIDO2 key, U2F key, TOTP,](https://www.token2.swiss/site/page/using-bitwarden-passkey-functionality-with-token2-fido2-security-keys) Also note that some older OS versions may not support the PRF feature ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 10:08am UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/3 "2025-11-14T10:08:26Z")
I opened the console in the browser while i try to read the key and get this error below in the picture. I never tried with bitwarden because i don’t have an account there, only vaultwarden. I tried once in nextcloud for the login without password and it works well. After reading the key the windows security popup come and i set the pin. In vaultwarden no popup window was there ![19746](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/6/660210bbbd741ce0f074cc866bfe53364221cdb9.jpeg) ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 10:27am UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/4 "2025-11-14T10:27:27Z")
what domain do you use? It should be an FQDN ([sub].domain.tld) and a valid TLS cert. Otherwise WebAuthN will fail ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 11:04am UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/5 "2025-11-14T11:04:04Z")
My domain is written like [xxxxxx-xxxxxx.duckdns.org](http://xxxxxx-xxxxxx.duckdns.org).. i have an ssl certificate from letsencrypt with the nginx proxy manager. ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 11:22am UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/6 "2025-11-14T11:22:31Z")
And you have the RP matching it in the configuration? ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 12:25pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/7 "2025-11-14T12:25:17Z")
What do you mean with RP? ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 12:29pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/8 "2025-11-14T12:29:39Z")
Thats my docker compose yml ![19777](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/2X/b/b1fa2898406c9c7a7d1c8e4f75e30c7ad844ee62.jpeg) ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 12:30pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/9 "2025-11-14T12:30:48Z")
Ah i know what you mean, i tried rp with the full domain and with the one in the picture below. It doesnt matter ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 12:36pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/10 "2025-11-14T12:36:22Z")
It does matter; your web interface opens as [xxx-xxx.duckdns.org](http://xxx-xxx.duckdns.org), but the WebAuthN RP is set to [duckdns.org](http://duckdns.org). this will not work, it should be the same as domain Also, the port matters, normally you should be accessing your web using h ttps://xxx-xxx.duckdns.org/ do you have :8081 added to the URL? ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 12:50pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/11 "2025-11-14T12:50:40Z")
no vaultwarden is on port 8081 from the ip on my server at home. ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 2:28pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/12 "2025-11-14T14:28:20Z")
Then you can try to specify that in the RP field, oe [xxx-xxx.duckdns.org:8081](http://xxx-xxx.duckdns.org:8081) ---
**Author:** ![simon.hirz](https://avatars.discourse-cdn.com/v4/letter/s/9de0a6/32.png) [@simon.hirz](https://vaultwarden.discourse.group/u/simon.hirz)\ **Post date:** [November 14, 2025, 4:12pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/13 "2025-11-14T16:12:46Z")
I think i found the mistake. In my case Nginx pm forwardhostname is an ip with the forward port 8081. I think vaultwarden wants an domain here too, but i dont know i should do that in my network ---
**Author:** ![eheh](https://avatars.discourse-cdn.com/v4/letter/e/b2d939/32.png) [@eheh](https://vaultwarden.discourse.group/u/eheh)\ **Post date:** [November 14, 2025, 4:25pm UTC](https://vaultwarden.discourse.group/t/2fa-with-token2/4889/14 "2025-11-14T16:25:15Z")
You can test internally first using hosts file