Build the compatibility matrix first
List the accounts that matter most: primary email, work identity, password manager, financial and developer services, device accounts, and recovery email. For each, record whether FIDO2/WebAuthn or security keys are supported, whether an administrator must enable them, which browsers and mobile apps work, and whether the key is used for sign-in, second factor, or passkey storage.
Choose physical interfaces for every device
USB-C plus NFC can cover many modern laptops and phones, while USB-A remains common on desktops and managed equipment. Check port depth, cases, hubs, and whether adapters are permitted. NFC improves phone access only where the service's mobile flow supports it. Avoid making one small adapter the single point of failure for all recovery and travel situations.
Do not equate every black key
Yubico and other vendors sell FIDO-only, multi-protocol, biometric, enterprise, and certified variants that can look similar. Match the exact model number and firmware generation to FIDO, smart-card, OTP, OpenPGP, or organizational requirements. Paying for extra protocols adds no protection if they are not configured, while buying a FIDO-only key will not satisfy an unrelated smart-card policy.
Enroll the spare before tightening the account
Add at least two approved keys where the service allows it, name them clearly in the account, and test each in a fresh session. Store the spare away from the primary key and devices. Generate and secure recovery codes according to the service. Only after recovery works should you consider removing less phishing-resistant factors, and organizational policy may control that decision.
Plan loss, replacement, and handoff
Write a short recovery procedure that identifies the accounts, spare location, administrator contact, and how a lost key is removed. Do not write account passwords on the key. Periodically confirm both keys still work, especially before travel or replacing a phone. A durable key reduces some risks, but physical custody, account hygiene, device security, and prompt revocation still matter.