I’m opening a new thread because the original discussion about TrustKey hardware keys has now been automatically closed.
I wanted to provide the final outcome of my support case, because I believe this information is important for other individual Daybreak users.
What happened
I purchased a TrustKey T120 USB-C specifically to comply with the new Daybreak hardware security key requirement before the October 1 deadline.
The TrustKey T120 is a physical FIDO2/U2F security key.
Enrollment itself worked correctly. I tested it on both:
- iPhone/iOS
- Windows 11
In both cases:
- I explicitly selected Security key
- the physical TrustKey was detected
- the key’s FIDO2 PIN was requested
- a physical touch of the hardware key was required
- enrollment completed successfully
- OpenAI sent confirmation that a new security key or passkey had been added
However, after enrollment, OpenAI displayed the newly registered credential simply as:
“Passkey”
while the Daybreak eligibility page continued to display:
“To continue, add a hardware key.”
The Continue button remained disabled.
Support investigation
I opened a support case with OpenAI and went through several troubleshooting steps.
Initially, Support suggested that an active OpenAI/ChatGPT incident might have affected how newly registered hardware keys were being classified.
After that incident was marked resolved, I removed and registered the TrustKey T120 again. The result was exactly the same.
The case was then escalated.
OpenAI Support asked me to provide a continuous screen recording showing the complete process:
- the Daybreak requirement not being satisfied
- adding the TrustKey T120 through the Security key flow
- successful FIDO2 enrollment
- the resulting credential appearing as “Passkey”
- returning to the Daybreak eligibility page
- the hardware-key requirement still being unsatisfied and Continue still disabled
I provided that recording.
Final answer from OpenAI Support
OpenAI has now clarified the actual requirement.
For individual Daybreak access, a physical key must not simply support FIDO2.
According to the explanation I received, the key must also:
- store private keys in secure hardware in a way that prevents their export; and
- be identifiable by OpenAI through trusted authenticator metadata, such as the FIDO Alliance Metadata Service.
OpenAI Support then explicitly confirmed:
TrustKey T110 and T120 keys are currently ineligible for individual Daybreak access.
This explains the behavior: the T120 is a real physical FIDO2 authenticator and completes WebAuthn enrollment correctly, but it is not considered a qualifying Daybreak hardware security key.
Support also clarified another important point:
individual Daybreak users need at least two secure sign-in methods, but only one needs to be a qualifying physical FIDO2 security key.
An existing software/synced passkey may remain as the second method. A second physical security key is optional.
The documentation has now been updated
The official OpenAI Daybreak troubleshooting documentation has now been updated and explicitly states that not all FIDO2 hardware security keys are supported.
It now specifically identifies TrustKey T110 and T120 as currently ineligible for individual Daybreak access.
This is useful information, but my concern is the timing and clarity with which it became available.
Existing individual Daybreak users were given an October 1 deadline to satisfy the hardware-key requirement.
When I purchased the T120 specifically for Daybreak, the important distinction between:
“physical FIDO2 security key”
and
“physical FIDO2 security key that qualifies for Daybreak”
was not made sufficiently clear in the guidance I relied on.
Had the TrustKey T110/T120 incompatibility, or the underlying metadata/attestation requirements, been clearly documented beforehand, I obviously would not have purchased a T120 for this purpose.
Instead, the result was:
- purchasing hardware specifically for the requirement
- multiple enrollment attempts on iOS and Windows
- troubleshooting with Support
- escalation to a specialist
- recording and submitting a complete reproduction
- and only then receiving confirmation that the model itself was not eligible
To OpenAI Support’s credit, they ultimately provided a clear technical explanation and explicitly apologized for the conflicting guidance and for the additional time or expense this may have caused.
But I think this should have been clear before users were required to purchase hardware and before the compliance deadline took effect.
What I think would improve this
OpenAI should consider publishing and maintaining:
- a clear list of known qualifying hardware security keys/models
- the exact technical requirements for Daybreak hardware eligibility
- the relevant authenticator metadata / attestation requirements
- a clear distinction between FIDO2 compatibility and Daybreak eligibility
- guidance for users whose already-purchased FIDO2 hardware turns out not to qualify
- and an appropriate grace period when important compatibility requirements are clarified close to, or after, a compliance deadline
I am not questioning the decision to require stronger hardware-backed authentication for Daybreak.
The issue is that users need enough information to know which hardware actually satisfies those requirements before they are asked to purchase it.
In practice, “FIDO2 hardware security key” was not a sufficiently precise purchasing requirement.
Hopefully this follow-up saves other users from purchasing a perfectly functional physical FIDO2 key that nevertheless does not qualify for Daybreak.