How to use SafeKey as a FIDO2 passkey with Proton Mail

Proton Mail is a privacy-focused email service that uses end-to-end encryption, meaning only the sender and recipient can read the content of an email. It also offers zero-access encryption, meaning Proton itself cannot access the contents of emails. This focus on security and privacy makes it a popular choice for individuals and organizations seeking to protect their communications

Once you have registered your FIDO2 key with Proton, the key will be ready to be used as an authentication method when accessing your account;

Register your FIDO2 key in your Proton Mail account

Before you can use your FIDO2 key as an access method for your Proton account you will need to register the key with Proton using the following procedure;

Log in to your Proton Mail account, then select "Proton Mail";
Click on the setting icon (), then click on the button;;
In the left hand column of the page, click on the menu link "Account and password";
Next, scroll down to the section "Two-factor authentication";
Before a Fido key can be used as an authentication method you will first need to ensure that the authenticator app option is enabled (this will allow authentication either using an authenticator app, or via a hardware token.
If your Security key 2FA option is greyed out (as in the example above), then you will first need to add an authentication app (or hardware token) using the following procedure;
Log in to your Proton Mail account then select "Proton Mail";
Click on the setting icon (), then click on the button;;

In the left hand column, click on "Account and password";
Then scroll down to the section "Two-factor authentication", and at the prompt "Authentication app", enable this feature by clicking on the slider (indicated below);
A window will now open requesting your password;
Supply your proton mail password, then click .
A new window titled "Set up two-factor authentication" will now open;
Click , and you will be presented with a QR code;
You can use the QR code to program our programmable tokens using the instructions found in the following procedure;
We have a range of programmable tokens that can act as direct replacements for an authentication apps.
Programming single seeded tokens using a QR code on a windows PC
Single seeded tokens (such as the SafeID/Diamond and the SafeID/Pro) can be programmed using a windows PC using the following procedure;

Download and launch the SafeID/Diamond programming tool.
Click the Scan QR Code button
Before you scan the QR code please ensure that the clock on your computer is displaying the correct date and time.
You can scan the screen for a QR code, or load from a file.
If you are scanning the barcode on the screen please ensure that the QR code is not obscured by other windows, and if you have more than one monitor please ensure that both the app and the QR code are displayed on the main display (display 1).
If you still have difficulty in scanning the QR code double check you only have the one instance of the app running, and that it is the latest version of the app. In most cases when there are issues with scanning of the QR code the most likely cause is the QR code contains the wrong data and may need to be regenerated. To test the QR code you could check that the code works correctly with the authenticator app it is intended for (e.g microsoft authenticator), and if this fails then you know that the QR code will need to be regenerated.
Select Scan Screen.
If succeeded, the Seed box should be filled with the token's seed data.
Now, select your smart card reader from the Reader drop-down list, e.g. "HID OMNIKEY 5427 CK"
Press the Connect button
Now, switch on a SafeID token and place it on the reader.
The tool will read out the token's serial number and time, and display them:
If you want to correct the clock on the token, then leave the "Sync Token Clock" checked, but first ensure the time on your pc is set correctly.
Press the Burn button
The token is successfully programmed.
Switch off the token and switch it on again to generate a new code (the token may only use the new seed after being reset)

Programming single seeded tokens using a QR code on an Android mobile phone
Single seeded tokens (such as the SafeID/Diamond and the SafeID/Pro) can be programmed using an android mobile phone using a procedure that is similar to the windows procedure, but using the following instructions;

Introduction
There are circumstance where you may want to replace a mobile phone based authentication app (such as google authenticator) with a programmable hardware token (such as the SafeID/Diamond or SafeID/Pro programmable tokens).

Preparation
Before you can use an NFC enabled phone to burn programmable tokens you will need to perform the following preparatory steps;

Make sure you’re running the latest version of Android (the majority of new Android smartphones have an NFC chip in the phone).
Turn on your device and slide from the top down to access the android settings.
Maximise the displayed icons then ensure the "NFC" icon is enabled;

If asked if you want to turn on "Android Beam", confirm that you want the feature enabled.

If your mobile device runs android you will need to visit the Google play store and search for the app "Deepnet SafeID Programmer"
Download, Install and run this app.

Before you can produce OTP codes using a programmable token you will need to obtain the seed data (either in the form of a compatible QR code that can be scanned, or in hex or base32 encoded format).
Once the seed data for the token has been obtained it can be transferred to the app either by scanning the QR code, or manual entry of the Base32/Hex encoded seed:
When scanning a QR Code on an Android (or IOS) SafeID programming App you first need to make ensure that the QR code is ready for scanning using the camera on your smartphone.
Display the QR Code ready for scanning (the QR code below is just an example);

Next launch the app on your mobile device,, point the camera at your QR code, then click on the button;

After clicking on the the button point the camera the QR code and the code will be automatically scanned;

The token's seed/secret is extracted from the QR code, and you will progress onto the next step "Token Configuration";

You are now ready to burn the seed details onto the token.
Manual entry of the seed may be performed with either a Base32, or Hex encoded seed.
Copy and paste your seed into the input area then click ;
The software will then examine your seed and confirm if it is a valid Base32 or Hex seed (If the programming app cannot identify a valid seed then you may be requested to correct the entry).
When a valid seed has been entered you will still need to confirm the time and algorithm parameters.
Generally speaking, if the token is to be replacing an authentication app, then these parameters can be left at their default settings (but if you are aware that either a different time window size, or algorithm setting are needed, then you will need to manually adjust these settings from the default.
Once the token configuration settings match your requirements click on the button;
You are now ready to burn the seed details onto the token.

Burning Seed data onto the Programmable Tokens using an NFC enabled smartphone
Once the token parameters have been confirmed you will be asked to turn on the token.
Turn on the token then click ;
The app will update to show that the token is currently not connected to the app;
With NFC on the mobile enabled, ensure your token is turned on, then place the token near the NFC reader on your phone (typically this will be near the top at the back of your phone).
The app will update and show that the token is now connected, and will display details about the token that it has found;
Part of the information displayed is an assessment of any time drift that has been detected on your token.
Generally speaking, if more than 2 seconds drift has been detected we would advise you click on the "Synchronise Token Clock" option prior to burning your token.
If you are ready to burn the token click on the button, and the token details will be transferred to the token, and you will notified with the message "TOKEN PROGRAMMED SUCCESSFULLY";
Related Articles
Programmable Tokens and keys
Hardware Tokens
NFC Card Reader
How to convert seed data between Hex and Base32 encoding

Programming single seeded tokens using a QR code on and iOS mobile phone
Single seeded tokens (such as the SafeID/Diamond and the SafeID/Pro) can be programmed using an iOS mobile phone using a procedure that is similar to the windows procedure, but using the following instructions;

Introduction
There are circumstance where you may want to replace a mobile phone based authentication app (such as google authenticator) with a programmable hardware token (such as the SafeID/Diamond or SafeID/Pro programmable tokens).
Before you can produce OTP codes using a programmable token you will need to obtain the seed data in the form of a compatible QR code.

Preparation
Before you can use an NFC enabled phone to burn programmable tokens you will need to perform the following preparatory steps;
Enable NFC on your iOS smartphone
Install our SafeID programming app on your phone
Enabling NFC
The following procedure can be used to enable NFC on your iOS smartphone;

iPhones 7 and the more recent released models can read NFC tags and make NFC payments. However, no NFC support was added to iPhones 6 and 6S, yet it can be used to make NFC payments only.
NFC is automatically enabled in Apple phones.

Installing the SafeID Programmer on your phone
The SafeID programming app is available for download in versions suitable for Windows, Android and iOS devices.
Instructions for downloading the programming app on your iOS device;

If your mobile device runs android you will need to visit the apple play store and search for the app "SafeID Programmer"
Download, Install and run this app.

Burning Seed data onto the Programmable Tokens using an NFC enabled smartphone
When scanning a QR Code on an Android (or IOS) SafeID programming App you first need to make ensure that the QR code is ready for scanning using the camera on your smartphone.
Display the QR Code ready for scanning (the QR code below is just an example);

Next launch the app on your mobile device, and use the following instructions to burn the programmable token;

Launch the app, point the camera at your QR code, then click on the button to scan the image;

After the QR Code has been scanned you will find that the seed details have been automatically added to the app and you will be ready to burn the seed details onto the token.

Switch on the programmable token and place it against the back of the phone, then use the button to start burning the token.
When you hear a beep, do not move the token until you hear the second beep, and the message "Token programmed successfully" will be displayed (indicating that the token has been programmed).
Related Articles
Programmable Tokens and keys
Hardware Tokens
NFC Card Reader

Programming multi-seeded tokens
If you have a multi seeded programmable token (such as the SafeID PinPad(pro) or SafeID QR(pro), then please see the instructions in the following guides;
SafeID PinPad(Pro) Programming Tools
SafeID QR(Pro) Programming Tools
Related Articles
Programmable Tokens and keys
Hardware Tokens
NFC Card Reader
Checking and resolving time drift on a windows computer
How to generate QR codes for authenticator apps or programmable tokens
How to extract seed data from a QR code using a PC
Verifying your token
Once you have programmed your token you will need to verify it with Proton Mail.
Click , and you will be asked for the 6 digit OTP code;
Enter a code from your programmable token and you will be provided with a backup codes (these codes should be stored for emergency use);
You are now ready to use your programmable token as an OTP source when you next log in to your proton mail account.
Related Articles
OTP Tokens
Programmable Tokens and keys
NFC Smart Card Reader
How to use SafeKey as a FIDO2 passkey with Proton Mail
Once you have added the backup authentication method (Authenticator app or programmable token), the first option ("Authenicator app") will be ticked, and second ("Security key") will be available (example below);
To enable logon using a Fido2 key, enable the slider "Security Key", enable this feature by clicking on the slider (indicated below);
You will be prompted to enter your Proton password, enter your proton password then click ;
Now enter an OTP code (either from your authentication app, or programmable hardware token);

Once the OTP code has been entered you will be ready to register your Fido2 key, click ;
You will now be presented with a list of possible passkeys, select "Security Key", then click ;
You are now notified that access to google will be prepared with your Fido2 security key - click to proceed to the next step;
Google will now ask permission to examine your Fido2 key, insert the key into a USB port then click ;
You will mow be asked to touch the button on your key (if your model has a fingerprint reader you may be asked to provide a finger swipe instead);
Provided you press the button on the Fido2 key in the allowed time, the passkey details will be stored on your Fido2 key, and you will be presented with the following confirmation;
You will now be offered the opportunity to name your security key.
In the field "Key name", supply a suitable name then click
You will now be notified that the security key has been registered, click
Your Fido2 key has now been registered with Proton mail, and is ready to be used when logging on to the application;