---
title: "Pair a Device to the Keychain"
slug: "pair-a-device-to-the-keychain"
updated: 2023-05-11T18:22:58Z
published: 2023-05-11T18:22:58Z
canonical: "docs.axiad.com/pair-a-device-to-the-keychain"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pair a Device to the Keychain

When plugging in for the first time a device (YubiKey, etc.) that has been already initialized, the user will be asked to associate the token to the account currently logged on.

## Prerequisites

- The smart card device must already be personalized with a certificate for PIV authentication. See [Add an Identity Device](/v1/docs/add-device) for procedures.
- Ensure smart card pairing is enabled on your machine.

## To Pair a Device Using SmartCard Pairing

1. Insert the smart card device in the card reader or USB port.
2. Select the card identity to use and click **Pair**.
3. Enter your **password** and click **Pair**.
4. Enter your **PIN** and click **OK**.
5. Re-enter your **password** and click **OK**.  
You can now use your device to open and unlock both your session and your keychain. Any system prompt to authenticate will now ask for the card PIN.

## To Pair a Device Using the Command Line

1. Open **Terminal**.
2. Run the sudo sc_auth identities command to list all certificates available for authentication on the smart card device (YubiKey).

```custom
SmartCard: com.apple.pivtoken:BA2A35B49A275645BD5D60593E7E7C89
Unpaired identities:
B912C8D7CB081E17B457BE7F4283E476D0174877 Certificate For Digital Signature
(FirstName LastName)
883B74CF2E6512B5F2FAEE6D92D3F56B9DCFB294 Certificate For PIV Authentication
(FirstName LastName)
```
3. Highlight and copy the hash listed for the certificate you want to use.
4. Run the sudo sc_auth pair -u <user> -h <hash> command, where <user> is the current user logged in to the Mac (which may or may not be different from the user listed in the certificate details above), and <hash> is the hash corresponding to the certificate to map.  
NOTEIf working with the currently-logged on user, use $(whoami) for the username. You do not need elevated privileges (sudo).Example command: sudo sc_auth pair -u $(whoami) -h 883B74CF2E6512B5F2FAEE6D92D3F56B9DCFB294
5. When the **Enter PIN** dialog box displays, enter your device PIN.
6. Click **OK**.  
You can now use your device to open and unlock both your session and your keychain. Any system prompt to authenticate will now ask for the card PIN.