I'm trying to automate an authentication canary in a workflow that includes a mandatory Yubikey OTP (the 44-character unique password). Is there a way to configure a single Yubikey in such a way that I can generate the Yubikey long-touch OTP via script or API call without requiring touch?


Even if there were, you have effectively bypassed the one useful feature of the Yubikey: external verification is required for access to the TOTP token.

If you control the workflow then perhaps switch to another OTP mechanism where you can use the secret programmatically. Or remove OTP for a limited set of circumstances dictated by your threat model, e.g. for one user from one IP.

If you don’t control the workflow then consider hacking the Yubikey with an Arduino, a USB controlled switch or similar. The “button” is simply a capacitive sensor.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.