Deep-dive on the Next Gen Platform. Join the Webinar!

Skip Navigation
Show nav
Dev Center
  • Get Started
  • Documentation
  • Changelog
  • Search
  • Get Started
    • Node.js
    • Ruby on Rails
    • Ruby
    • Python
    • Java
    • PHP
    • Go
    • Scala
    • Clojure
    • .NET
  • Documentation
  • Changelog
  • More
    Additional Resources
    • Home
    • Elements
    • Products
    • Pricing
    • Careers
    • Help
    • Status
    • Events
    • Podcasts
    • Compliance Center
    Heroku Blog

    Heroku Blog

    Find out what's new with Heroku on our blog.

    Visit Blog
  • Log inorSign up
Hide categories

Categories

  • Heroku Architecture
    • Compute (Dynos)
      • Dyno Management
      • Dyno Concepts
      • Dyno Behavior
      • Dyno Reference
      • Dyno Troubleshooting
    • Stacks (operating system images)
    • Networking & DNS
    • Platform Policies
    • Platform Principles
  • Developer Tools
    • Command Line
    • Heroku VS Code Extension
  • Deployment
    • Deploying with Git
    • Deploying with Docker
    • Deployment Integrations
  • Continuous Delivery & Integration (Heroku Flow)
    • Continuous Integration
  • Language Support
    • Node.js
      • Working with Node.js
      • Node.js Behavior in Heroku
      • Troubleshooting Node.js Apps
    • Ruby
      • Rails Support
      • Working with Bundler
      • Working with Ruby
      • Ruby Behavior in Heroku
      • Troubleshooting Ruby Apps
    • Python
      • Working with Python
      • Background Jobs in Python
      • Python Behavior in Heroku
      • Working with Django
    • Java
      • Java Behavior in Heroku
      • Working with Java
      • Working with Maven
      • Working with Spring Boot
      • Troubleshooting Java Apps
    • PHP
      • PHP Behavior in Heroku
      • Working with PHP
    • Go
      • Go Dependency Management
    • Scala
    • Clojure
    • .NET
      • Working with .NET
  • Databases & Data Management
    • Heroku Postgres
      • Postgres Basics
      • Postgres Getting Started
      • Postgres Performance
      • Postgres Data Transfer & Preservation
      • Postgres Availability
      • Postgres Special Topics
      • Migrating to Heroku Postgres
    • Heroku Key-Value Store
    • Apache Kafka on Heroku
    • Other Data Stores
  • AI
    • Working with AI
  • Monitoring & Metrics
    • Logging
  • App Performance
  • Add-ons
    • All Add-ons
  • Collaboration
  • Security
    • App Security
    • Identities & Authentication
      • Single Sign-on (SSO)
    • Private Spaces
      • Infrastructure Networking
    • Compliance
  • Heroku Enterprise
    • Enterprise Accounts
    • Enterprise Teams
    • Heroku Connect (Salesforce sync)
      • Heroku Connect Administration
      • Heroku Connect Reference
      • Heroku Connect Troubleshooting
  • Patterns & Best Practices
  • Extending Heroku
    • Platform API
    • App Webhooks
    • Heroku Labs
    • Building Add-ons
      • Add-on Development Tasks
      • Add-on APIs
      • Add-on Guidelines & Requirements
    • Building CLI Plugins
    • Developing Buildpacks
    • Dev Center
  • Accounts & Billing
  • Troubleshooting & Support
  • Integrating with Salesforce
  • Security
  • Identities & Authentication
  • Security Keys

Security Keys

English — 日本語に切り替える

Last updated June 16, 2023

Security keys are small physical devices that are easy to use for multi-factor authentication (MFA) because there’s nothing to install and no codes to enter. If you’re unable to use a mobile device to log in to Heroku, security keys are an effective option.

Options for security keys include Yubikey or Google Titan Key.

Choosing a Security Key

You can use any USB, Lightning, or NFC security key that’s compatible with the FIDO WebAuthn (FIDO2) standard, including Yubico’s YubiKey or Google’s Titan Key.

Security keys require a supported browser such as Chrome™, Firefox®, Edge™, or Safari® to act as an intermediary between the key and Salesforce.

WebAuthn-compatible keys aren’t supported in non-Chromium versions of the Edge browser.

Heroku has verified security key functionality in multiple environments. To ensure compatibility, consult vendor documentation for specific questions related to security key support in your environment.

If you don’t have your primary method available, we strongly recommend that you configure a secondary MFA verification method such as recovery codes to avoid loss of access.

Registering a Security Key

To register a security key as an MFA verification method:

From Account Settings, select Setup Multi-Factor Authentication. Or if you already enable other verification methods, select Manage Multi-Factor Authentication.

On the next page, choose Add Security Key and follow the prompts to complete registration. Your registration experience can vary based on the browser and the form factor of the key in use. In general, registration involves these steps.

  • To add a security key, click Register.
  • When prompted, ensure that the security key is inserted in the appropriate port or connected via NFC, then activate it.
  • Name your key, and complete registration.

Add Security Key

MFA Verification with a Security Key

To log in with a security key:

  • After entering your email and password, you’re prompted to verify your login with your security key.
  • Insert or connect the key, then click Verify. Your experience to complete logging can vary based on the browser and the key’s form factor.

Login with Security Key

Keep reading

  • Identities & Authentication

Feedback

Log in to submit feedback.

Two-Factor Authentication (deprecated) SMS as an MFA Verification Method (DEPRECATED)

Information & Support

  • Getting Started
  • Documentation
  • Changelog
  • Compliance Center
  • Training & Education
  • Blog
  • Support Channels
  • Status

Language Reference

  • Node.js
  • Ruby
  • Java
  • PHP
  • Python
  • Go
  • Scala
  • Clojure
  • .NET

Other Resources

  • Careers
  • Elements
  • Products
  • Pricing
  • RSS
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku Blog
    • Heroku News Blog
    • Heroku Engineering Blog
  • Twitter
    • Dev Center Articles
    • Dev Center Changelog
    • Heroku
    • Heroku Status
  • Github
  • LinkedIn
  • © 2025 Salesforce, Inc. All rights reserved. Various trademarks held by their respective owners. Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States
  • heroku.com
  • Legal
  • Terms of Service
  • Privacy Information
  • Responsible Disclosure
  • Trust
  • Contact
  • Cookie Preferences
  • Your Privacy Choices