On OpenBSD Yubikeys no longer attach as keyboards, but they do still attach as HID devices. We can read codes from the device with a little work. Running this script should find the appropriate uhid device and loop over reading OTP messages from it.

read-yubikey.pl

#!/usr/bin/perl
use v5.36;
use builtin qw< indexed true false >;

# Copyright (c) 2026 Andrew Hewus Fresh <andrew@afresh1.com>
#
# Permission to use, copy, modify, and distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

=head1 NAME

read-yubikey -- Read output from yubikey OTP on OpenBSD

=head1 SYNOPSIS

    read-yubikey [ 0 | uhid0 | /dev/uhid0 ]

=head1 DESCRIPTION

On OpenBSD Yubikeys no longer attach as keyboards,
but they do still attach as HID devices.
We can read codes from the device with a little work.

Running this script should find the appropriate uhid device
and loop over reading OTP messages from it.

=cut

# https://wiki.osdev.org/USB_Human_Interface_Devices#Report_format
# https://gist.github.com/mildsunrise/4e231346e2078f440969cdefb6d4caa3
my %MODIFIERS = reverse indexed qw<
    LEFT_CTRL  LEFT_SHIFT  LEFT_ALT  LEFT_GUI
    RIGHT_CTRL RIGHT_SHIFT RIGHT_ALT RIGHT_GUI
>;

sub decode( $mod, $code ) {
    return 'ENTER' if $code eq 0x28;

    if ( 0x04 <= $code <= 0x27 ) {
        my $shift
            = $mod & ( $MODIFIERS{LEFT_SHIFT} | $MODIFIERS{RIGHT_SHIFT} );
        my $offset = $shift ? 0x41 : 0x61;
        return chr( $code + $offset - 0x04 );
    }

    return;
}

my $warned = false;

while (1) {
    my $uhid = @ARGV ? $ARGV[0] : do {
        my %found;
        my $i = 0; # keep track of the order they are found

        open my $fh, '-|', qw< /sbin/dmesg >
            or die "Unable to spawn dmesg $!";
        while ( readline $fh ) {
            my $uhidevs = join '|', keys $found{uhidev}->%*;

            next unless /^(?:
                (?<type>uhidev)      (?<id>\d+) \s .* Yubikey
              | (?<type>uhid)        (?<id>\d+) \s+ at \s+ uhidev(?:$uhidevs):
              | (?<type>uhid(?:ev)?) (?<id>\d+) \s+ (?<detached>detached)
            )/ax;

            #say STDERR "$+{type}$+{id} "
            #    . ( $+{detached} ? "detached" : "found" );

            if ( $+{detached} ) {
                delete $found{ $+{type} }{ $+{id} };
            }
            else {
                $found{ $+{type} }{ $+{id} } = $i++;
            }
        }
        close $fh;

        # Use the last key found
        my ($id)
            = sort { $found{uhid}{$b} <=> $found{uhid}{$a} }
            keys $found{uhid}->%*;

        unless ( length $id ) {
            say STDERR "Monitoring dmesg for Yubikey" unless $warned;
            $warned = true;
            sleep 3;
            next;
        }

        $id;
    };
    $warned = false;

    $uhid = "uhid$uhid" if $uhid      =~ /^\d+$/;
    $uhid = "/dev/$uhid" unless $uhid =~ /^\//;

    my $buf = '';
    open my $fh, '<', $uhid or die "$0: unable to open $uhid: $!\n";
    say STDERR "Reading from $uhid";
    while ( read $fh, my $rec, 8 ) {
        my ( $mod, undef, @codes ) = unpack "C*", $rec;

        for (@codes) {
            my $key = decode $mod, $_;
            next unless $key;

            if ( $key eq "ENTER" ) {
                say $buf;
                $buf = '';
                next; # could exit to read a single value
            }

            $buf .= $key;
        }
    }
    close $fh;
}