OnePass brochure: form factors, deployment and standards
A printable overview of OnePass, the AmbiSecure hardware-backed identity platform — smart card, USB key, biometric card, validation server, lifecycle — for organisations that need device-bound identity rather than syncable convenience. The product itself is described on the OnePass Platform page.
Why a platform, not just a key
Authenticators are easy to ship. The hard parts are issuance, recovery, revocation, and attestation policy. OnePass ships all four out of the box. You get the keys plus the operational layer that makes them deployable at scale.
Form factors
| Form factor | What it’s for |
|---|---|
| OnePass Card | Smart card + FIDO2 + NFC. Carries badge artwork, unlocks workstations, taps for physical access. |
| OnePass Bio Card | Smart card with on-card fingerprint sensor. CTAP2.1 biometric enrolment. No typing a PIN. |
| OnePass USB Key | FIDO2 hardware key. USB-A or USB-C. For shared workstations, travel, backup. |
| OnePass platform server | FIDO Validation Server, AAGUID allow-list, MDS verification, lifecycle integration. |
Standards
FIDO2 · CTAP2.1 · WebAuthn Level 2 · ISO/IEC 7816 · ISO/IEC 14443 · X.509 · OpenID Connect.
Certified at the component level under the standards each component targets — see the certifications page for the active list.
Deployment shape
- Issuer keys generated under M-of-N inside an HSM.
- Cards / keys personalised under issuer keys, in-house at AmbiSecure or on the issuer’s or manufacturer’s line using AmbiSecure personalisation tooling.
- Validation Server deployed (cloud or on-prem).
- IdP integration: Okta, Microsoft Entra ID, Ping — FIDO2 factor enabled, AAGUID allow-list pinned to your AAGUIDs.
- Issuance line: in-person at IT desk for office estate; in-region for distributed workforce.
- Recovery flow: sealed backup credential, in-person re-issuance, M-of-N break-glass.
What it replaces
- SMS / TOTP MFA — eliminated by origin-bound FIDO2.
- Push-fatigue MFA — eliminated by explicit user verification on hardware.
- Multiple credentials per user (badge + key + PIV card) — consolidated to one card.
- Untrusted bring-your-own keys — eliminated by AAGUID + MDS attestation policy.
Engineering footprint
No agent on the user’s machine. Standard WebAuthn at the relying party. Standard CTAP2.1 at the authenticator. The platform server speaks standard FIDO Metadata Service. Your IT team integrates through their existing IdP admin API, not through a custom AmbiSecure protocol.
Related on the AmbiSecure site
Sizing OnePass for your estate?
We’ll bring a one-page deployment sketch to the first call — AAGUID policy, issuance line, recovery flow, validation-server footprint.