# Canonical adds FIDO2 hardware key support to Launchpad API access

> **Key takeaway:** Launchpad now supports hardware-bound OAuth refresh grants via USB FIDO2 keys to prevent unauthorized API access from stolen tokens.

**Published:** 2026-11-03T17:05:51+00:00 
**Source:** OMG! Ubuntu 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/canonical-adds-fido2-hardware-key-support-to-launchpad-api-a.html 

## Summary
Canonical has introduced support for FIDO2 hardware security keys within Launchpad, the platform used for building Ubuntu packages, hosting code, and managing PPAs. This update specifically targets developers using command-line tools such as lp-shell and ubuntu-archive-tools, which traditionally rely on stored text files or desktop keyrings for authentication.

By implementing hardware-bound tokens, Canonical aims to mitigate the risk of malware or unauthorized actors using stolen credentials. The new system replaces static stored tokens with long-lived OAuth refresh grants that require physical interaction with a USB security key to authorize new requests.

## Technical implementation of hardware-bound tokens
- **Authentication Mechanism:** The system utilizes a long-lived OAuth refresh grant that is cryptographically bound to a physical USB FIDO2 device.
- **Security Workflow:** Users must provide a PIN and physically touch the security key to authorize the issuance of short-lived tokens used for routine API requests.
- **Threat Mitigation:** While malware may still intercept a short-lived token during its active window, the hardware requirement prevents attackers from using stolen credentials to request new tokens.
- **Software Requirements:** Implementation requires the installation of the python3-fido2 package and is currently limited to USB-based security keys, excluding NFC or device-stored passkeys.

## Why it matters
This security enhancement protects the integrity of the Ubuntu software supply chain by securing the accounts of package uploaders and core distribution engineers. It provides a higher standard of protection for the tools and repositories that deliver software to millions of Linux users.