Yubico Forum

How to enroll in upgrade.yubico.com/getapikey programmatically?
I am using the C# client and I want to register the key and self-enrollment via code instead of going and registering the key manually from the website.

Hello,

The id/apiKey is per application, not per key. So you should only need to get one and store that for your application, no need to get one for each YubiKey used with your service.

/klas

but every time I register I get different
ClientID
SecretKey

and this is per key per registration

Hello,

Yes, every time you register a new id/key is generated, the registration is intended to be static for your application and it should just use one set of id/key, regardless of how many different YubiKeys you want to validate.

/klas

Sorry but I still can't get it

I have three Yubikey(s):

Now whenever I visit this page upgrade.yubico/getapikey,
it asks only for an email (fixed) and OTP (which is generated by the key)
The results is ClientID and SecretKey.

if I register the same yubikey1 again with the same email, I get different ClientID and SecretKey!
and if register different yubikey2 or yubikey3 with same email, I get different ClientID and SecretKey!

from what I see, everything is not fixed! where is the id/apiKey you talk about? and how do I connect the key1, 2 and 3 with the apikey?

So I'll try to explain again =)

The "Client Id" and "Secret Key" you get from https://upgrade.yubico.com/getapikey/ are only for identifying the application that verifies keys to YubiCloud, there is no connection between them and your YubiKeys.
Every time you register on the service you get a new id and a new key. The only reason you have to give us an OTP to get the id and key is that we want to limit abuse of the service.

/klas

Sorry for jumping in on an old thread.

Just to clarify, "Client Id" and "Secret Key" are for authenticating API client, correct?

So by default sending API request and receiving OK just means that someone has a working YubiKey, nothing more, correct?

To make sure that the key one of my own, I should first take what steps? Use returned OTP to extract identity part and compare it to white-listed identities?

Yes.



Correct.



Exactly.

/klas