Radiator Server Documentation — v10.34.1
YubiKey Context Variables
Context variables for Yubico OTP offline authentication
Table of Contents
yubikey Context Variables
Backends populate these variables before the yubikey action runs. After successful authentication the action updates yubikey.counter and yubikey.session; persist them to prevent replay attacks.
| Variable | Type | Required | Description |
|---|---|---|---|
yubikey.secret | Binary (16 bytes) | Yes | AES-128 key for offline decryption. Must be stored as a BLOB, not hex text. |
yubikey.public | String (12-char modhex) | No | Expected public UID. Rejects OTPs from other tokens when set. |
yubikey.private | Integer (48-bit) | No | Expected private UID inside the encrypted payload. Second identity check. |
yubikey.counter | Integer (16-bit) | No | Last accepted usage (power-on) counter. Enables replay detection. |
yubikey.session | Integer (8-bit) | No | Last accepted session (button-press) counter within a power cycle. |
Related Documentation
yubikeyactionyubikeyHTTP backend - Delegate OTP validation to an external Yubico server- YubiKey Authentication article