Your security device
What your Ledger Enterprise security device does, when you need it, and how to handle it safely.
Your Personal Security Device (PSD) is the credential that proves who you are and approves what you do. It is held on your Ledger device, a Ledger Stax. The PSD is personal: it represents you inside your Workspace and is not shared.
API users have no Ledger device. They approve over the API with their own key.
When you need it
Signing in
Yes. In a Workspace with single sign-on (SSO), you confirm on the device only once, to pair it. After that, you sign in through your identity provider. A browser that does not remember your Workspace uses the device to find it. See Signing in and out
Creating any Request, such as a transfer
Yes
Approving someone else's Request
Yes
Verifying a deposit address
Yes, and this is the point of the exercise
Rejecting a Request
No
Reading balances, history, Rules, or reports
No
Connect and unlock the device before starting a task rather than partway through.
Device and app requirements
A Ledger Stax, registered for your PSD user.
The Ledger Vault app on the device. The interface calls it the Vault app.
The required version of the Ledger Vault app. The platform sets this version. The check is an exact match: an earlier or a later version blocks every device action, sign-in included.
A cable to connect the device to your computer. If the browser asks you to choose a device, select your Ledger device.
Ordering Ledger Stax devices
Ledger supplies the Ledger Stax devices for Ledger Enterprise. Each device is attested for one Workspace before it ships.
To order new devices, open a support request in the Ledger support portal. See Contacting Ledger support. The support request must give:
the number of Ledger Stax devices;
the name of the Workspace that the devices must be attested for;
the recipient's full name, complete postal address, email address and phone number.
The steps of a device action
Every action that uses the device goes through the same first four steps. The interface shows one screen for each step. The last two screens show only when you create or approve a Request.
Unlock your device
Unlock the device with your PIN
Open the Vault app
Open the Ledger Vault app on the device
Preparing your device
Wait
Continue on Ledger Stax
Read the details on the device screen. Then confirm or decline on the device
Finalizing approval
Wait while the platform records your approval
Canceling approval
Wait. This screen shows when you decline on the device while you create a Request
You can close the Login dialog while it waits for you to unlock the device or to open the app. In every other action, the dialog stays open until the steps end or fail.
When an update is required
The action stops when the Ledger Vault app does not open, or when its version is not the required version. The interface then shows Update required on your device.
Select Start update. A Ledger page for device updates opens in a new browser tab.
Follow the instructions on that page. See On the update page.
Go back to the Ledger Enterprise tab.
Select Retry.
The Login page also has a link to update your device: Ensure your Ledger Stax is up to date. Both links open the same page, at onboarding.enterprise.ledger.com/update. You can open it at any time.
On the update page
The page is titled Update your Ledger device and install the Ledger Vault app. It updates the device firmware first. It then installs the required version of the Ledger Vault app.
Before you start:
Connect only one Ledger device to the computer.
Turn on the device, and unlock it.
Close the Ledger Vault app on the device. The firmware check needs the device on its home screen.
To update the device:
Select Verify my device.
Select Check firmware version. If the browser asks you to choose a device, select your Ledger device.
If a newer firmware exists, the page shows Firmware update available, with the installed version and the new version. Do these steps:
Select Download update.
If the page shows Allow manager, allow the Ledger manager on the device.
When the page shows Accept update, accept the update on the device.
Wait while the device restarts. The page shows Device is restarting....
If the device asks for your PIN, enter it.
Select Continue. If the device shows "Update mode", select Continue at once.
The page then checks the firmware again. It can show Finalizing update... while it completes the update.
When the firmware is up to date, the page checks the version of the Ledger Vault app. It shows Checking Vault app version....
If the Ledger Vault app is installed, open it on the device.
If the page shows Device is up-to-date. and the firmware version, select Install Vault app. The page shows Installing Vault app... and the progress.
The update is complete when the page says that the device is fully ready, and shows Firmware & Vault app ready.
If you opened the page with Start update, select Go back.
If you opened the page from the Login page, select Close.
If the required version of the Ledger Vault app is already installed, the page goes directly to this last screen.
Errors on the update page. Each error screen has a Retry button. Retry starts the check again from Check firmware version.
An action is required
The Ledger Vault app is open during the firmware check
Close the Ledger Vault app on the device. Then select Retry
Unlock your Ledger device
The device is locked
Unlock the device. Then select Retry
Connect exactly one Ledger device
More than one Ledger device is connected
Disconnect the other Ledger devices. Then select Retry
A message that the Ledger Stax firmware is not supported
Ledger Enterprise does not support the firmware version on the device
The message tells you to contact your technical account manager
Error, with the error name in some cases
Another error. The screen shows its description
Select Retry. If the error shows again, contact support
What it shows you
The device has its own screen, and what appears there is read from the secure hardware rather than from your browser. When you approve an operation, the recipient, the amount, and the operation type shown on the device are the ones that will actually execute.
Read them there. This is what makes the whole model work: see The security model.
Important: If the details on the device do not match your screen, decline on the device. Do not retry. Contact Ledger support.
As an Approver, also select Reject in the interface. Declining on the device does not reject the Request. It only interrupts your approval, and the interface shows Request approval interrupted. The Request stays pending, and other Approvers can still approve it.
As the Creator, declining on the device while you create a Request is different: the platform rejects the new Request. See Declining on the Ledger device.
Handling it safely
Keep it physically secure. Someone holding your unlocked device can act as you, within your role and your approval rights.
Never share your PIN, and never enter it anywhere other than on the device itself. Nobody at Ledger will ask for it.
Keep your recovery sheet offline and separate from the device. Anyone with it can reconstruct your access. See Your recovery sheet.
Disconnect when you are done, particularly on shared machines. To end your session in the interface, select Disconnect in the menu under your name. See Signing in and out.
Warning: Nobody legitimate will ever ask for your PIN or your recovery phrase, by email, chat, phone, or a web page. Any such request is an attack, whatever it appears to come from.
The practices that Ledger recommends for devices, PINs, recovery sheets and workstations are in Security good practice.
Your recovery sheet
Your recovery sheet holds the 24-word recovery phrase of your Ledger device.
Ledger Stax devices for Ledger Enterprise are attested for a Workspace. To recover your device, you restore the 24 words on a Ledger Stax that is attested for your Workspace. After a recovery from the 24 words, the restored Ledger Stax keeps the same device ID.
Keep your recovery sheet. This applies to every PSD user, Operators included. Without it, you cannot recover your device on an attested Ledger Stax.
Store it offline, in a physical safe. Security good practice gives the storage that Ledger recommends for each role.
Your device and the Workspace partition
Each Workspace has its own partition in the Hardware Security Module (HSM). When you register, the platform connects your Ledger device to the partition of your Workspace.
A Ledger device that is connected to another partition cannot complete a registration. The registration stops with Device already connected to another partition. The message tells you to disconnect the device in the Ledger Vault app settings, or to contact your Administrator.
The connection is stored on the device. Each time you create or approve a Request, the platform checks it first. If the device has no connection, the platform connects it again to your Workspace partition. No action is necessary.
The platform connects again only the Ledger device that is registered for your user.
If something is wrong
The browser does not detect the device
Check it is connected and unlocked, then reload. Try another cable or port before concluding it has failed
The browser does not detect the device on a Linux computer
Install the udev rules for Ledger devices. See Connecting on Linux
The interface shows Update required on your device
Update the Ledger Vault app. See When an update is required
Another message shows when you sign in or use the device
You cannot remember your PIN
Contact your Administrator. Do not keep guessing
The device is lost or stolen
Tell your Administrator immediately. A Master Administrator can suspend an Operator or an API user at once, with no Request. A Master Administrator cannot be suspended. Revoking any user needs an approved Request
The device is damaged
Contact your Administrator to arrange a replacement and re-registration. New devices are ordered from Ledger. See Ordering Ledger Stax devices
Losing the device does not put your organization's assets at immediate risk, because approval quorums mean one device is rarely sufficient on its own. It still needs reporting at once.
Connecting on Linux
The Ledger Enterprise interface and the update page connect to the Ledger device through WebHID, the browser interface for USB devices. On Linux, the browser can use the device only when udev rules give it access.
Ledger publishes these rules in the LedgerHQ/udev-rules repository (checked on 9 October 2026). Its script writes the rules to /etc/udev/rules.d/20-hw1.rules and reloads them. The script needs root rights.
Disconnect the Ledger device.
Open a terminal.
Run this command:
Connect the Ledger device, and unlock it.
Reload the Ledger Enterprise page.
Related
Setting up your device for the first time
To be completed.
Editorial note (remove before publishing): Cover the sequence for a new user: registration link, activation, PIN setup, and pairing with the Workspace. Also list the device models supported.
Last updated