BIO-key International, Inc. (Nasdaq: BKYI) has received FIDO Alliance Full Certification for Passkey:YOU, a workstation-based passkey authenticator the company says can give organizations centrally managed, phishing-resistant sign-in without requiring every worker to carry a phone or hardware token. For agencies that operate shared desks, secure facilities or device-restricted networks, the certification creates a standards-based identity option that can be evaluated alongside conventional security keys and mobile authenticators.
The development is consequential because those environments often do not fit the assumptions behind a personal passkey. Employees at a service counter, a dispatch center or a controlled operations room may rotate through the same workstation, lack permission to carry a phone, or work on a network where connecting personal devices is impractical. Issuing and recovering individual hardware tokens can also create an administrative burden when a large workforce changes roles or locations.
Passkey:YOU places the authentication hardware at the workstation, according to BIO-key. A user can unlock the service with a fingerprint scanner or an existing door-access badge; employees with phones can use the company’s MobileAuth application. The company said one enrollment can work with passkey-enabled identity platforms including Microsoft Entra ID, Okta, Ping and Duo, rather than needing a separate integration for every destination.
The FIDO Alliance certification confirms conformance with FIDO2 CTAP v2.0 at Security Assurance Level L1, BIO-key said. In practical terms, certification concerns whether an authenticator can use the standard interface expected by compatible services. It does not by itself validate an agency’s broader identity architecture, nor does it establish that the product has received a government authorization or is deployed by a public-sector customer.
BIO-key also positions the product differently from an unmanaged hardware key. The company said security teams can see which systems a workforce has registered, approve new destinations and revoke access to a particular system without retrieving a physical device. Those are company-described capabilities, and agencies considering them would need to test how the controls connect with their directory, privileged-access, audit and incident-response processes.
One potential use case would be a state emergency-management center where shift workers share workstations and cannot rely on personal smartphones during an incident. A centrally managed, standards-based passkey system could let the agency associate each login with an individual while avoiding the task of distributing a separate token to every temporary or rotating user. This is an illustrative scenario, not a disclosed deployment.
Biometrics add both a potential advantage and a procurement question. BIO-key said its system can use fingerprint, palm or face authentication, with credentials tied to the individual rather than left in a browser session or plugged into a computer. Before deploying such a system, agencies would still have to assess accessibility, biometric-data handling, retention, consent where applicable and fallback access for workers who cannot use a selected modality. The company did not disclose pricing, implementation timelines or named government users.
For public-sector security leaders, the certification matters less as a blanket replacement for existing multifactor authentication than as an interoperability milestone for a difficult class of workstation. Compared with an approach that treats every employee as a single-device user, a shared-authenticator model could give agencies another way to apply phishing-resistant controls in restricted and rotating-workforce settings. Its value will depend on policy controls, privacy safeguards and integration testing—not certification alone.