The AI lab has introduced a new security rule that obliges all users to log in with hardware‑backed passkeys, aiming to block phishing attacks and protect credentials.

OpenAI has announced a mandatory security upgrade that requires every user to log in with a hardware‑based passkey, a move designed to eliminate phishing attacks and safeguard credentials.

Why hardware passkeys are being enforced

OpenAI says the new rule will replace traditional passwords and SMS‑based two‑factor authentication, which are vulnerable to social engineering and credential‑stuffing attacks. By tying authentication to a physical device, the company aims to make unauthorized access significantly harder.

How the passkey system works

Users will need a compatible security key—such as a YubiKey or a device with built‑in biometric authentication—to complete the login flow. The passkey is stored securely on the device and never transmitted in plain text, reducing the attack surface for hackers.

  • Generate a passkey on a trusted device
  • Register the passkey with the OpenAI account
  • Use the passkey for each subsequent login

Impact on developers and enterprise customers

The requirement applies to all account tiers, including free, API, and enterprise users. OpenAI has provided migration tools and documentation to help developers integrate passkey support into their applications, but some smaller teams may need to acquire compatible hardware.

OpenAI will enforce the rule starting next month, giving existing users a grace period to enroll a passkey. Accounts that fail to comply will be temporarily locked until a valid passkey is added.

For more details on OpenAI’s security roadmap, see the OpenAI page on Momentum and explore related topics in the Product Design section.

“Hardware‑based authentication is the most reliable way to protect against credential theft,” OpenAI’s security team said in a statement.

Reuters coverage of OpenAI’s passkey mandate