The key in their pocket, signing inside the session.
YubiKey and other PIV smart-card devices sign inside the Cameyo session. The application sends a fingerprint of what is being signed to the desk, the user confirms it, and the signature comes back. The private key never leaves the device.
Built for the work your people already do.
Payment approvals
Release and approval steps that need a hardware-backed signature, not a password.
Regulated sign-off
Sign-offs that must be tied to a named person’s certificate, with a verifiable trail.
Strong authentication
Hardware-key proof of identity for applications running in the session.
Document and transaction signing
Legacy applications that already expect a smart card, delivered through Cameyo.
Three steps for the user. Nothing new to learn.
The application in the Cameyo session is unchanged. ASG-Deskside does the work at the desk, and sends only the finished result into the session.
The application asks for a signature
From inside the Cameyo session, as it would on a local PC.
The user confirms at the desk
ASG-Deskside shows what is being signed. The PIN goes to the card, never to the page.
The signature comes back
With the certificate, ready for the application to verify.
An entire signature and certificate reply.
Private keys that ever leave the device.
The user confirms each signature — it cannot be turned off.
Turns signing on for an application.
Safe by default.
- The private key never moves. Only a short fingerprint of the data leaves the session; the key stays on the YubiKey or card.
- Signing always asks a person. Each request shows what is being signed and is refused without a click.
- The PIN is unreachable by the page. It goes straight to the card in an isolated context — never written to the page, logged or kept.
- No substitutes. Pin a certificate and any other card is refused. Software keys are never used.
- Enabled per application. Off by default everywhere else, and it fails closed.
Windows and Chromebook.
| Desk | Status | How the device is reached |
|---|---|---|
| Windows desk | Working | The inbox smart card driver, through the small ASG-Deskside helper; TPM keys also supported |
| Chromebook | Working | Smart card access in the browser (PC/SC) |
Turning it on takes two steps.
Force-install the ASG-Deskside extension through Chrome or Edge policy. Windows desks also get the small native helper. Then tag the application:
Configuration settings
Set on the Cameyo application (or server, group or account), one per line. Every ASG-Deskside application also carries the extension ID and channel tags; we set these up with you.
| Setting | Default | What it does |
|---|---|---|
!ASG_SEAL_PIPE | 1 | Allows the session to ask for a signature or the certificate list. |
!ASG_SEAL_THUMB | none | Pins one certificate. Any other card is refused, never substituted. |
!ASG_SEAL_KEY | token, then TPM | Windows: token, tpm or any. Software keys are never used. |
Which application needs the signature, and which keys or cards do your people carry?
Tell us, and we will show you YubiKey & smart card signing working in your own Cameyo session.
Talk to usAlso in ASG-Deskside