> For the complete documentation index, see [llms.txt](https://help.enterprise.ledger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.enterprise.ledger.com/help-center-v2/start-here/get-started/your-device.md).

# Your security device

What your Ledger Enterprise security device does, when you need it, and how to handle it safely.

Your Personal Security Device (PSD) is the credential that proves who you are and approves what you do. It is held on your Ledger device, a Ledger Stax. The PSD is personal: it represents you inside your Workspace and is not shared.

API users have no Ledger device. They approve over the API with their own key.

## When you need it

| Action                                       | Device needed                                                                                                                                                                                                                                                                                                          |
| -------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Signing in                                   | Yes. In a Workspace with single sign-on (SSO), you confirm on the device only once, to pair it. After that, you sign in through your identity provider. A browser that does not remember your Workspace uses the device to find it. See [**Signing in and out**](/help-center-v2/start-here/get-started/signing-in.md) |
| Creating any Request, such as a transfer     | Yes                                                                                                                                                                                                                                                                                                                    |
| Approving someone else's Request             | Yes                                                                                                                                                                                                                                                                                                                    |
| Verifying a deposit address                  | Yes, and this is the point of the exercise                                                                                                                                                                                                                                                                             |
| Rejecting a Request                          | No                                                                                                                                                                                                                                                                                                                     |
| Reading balances, history, Rules, or reports | No                                                                                                                                                                                                                                                                                                                     |

Connect and unlock the device **before** starting a task rather than partway through.

## Device and app requirements

* **A Ledger Stax**, registered for your PSD user.
* **The Ledger Vault app** on the device. The interface calls it the Vault app.
* **The required version of the Ledger Vault app.** The platform sets this version. The check is an exact match: an earlier or a later version blocks every device action, sign-in included.
* **A cable** to connect the device to your computer. If the browser asks you to choose a device, select your Ledger device.

## Ordering Ledger Stax devices

Ledger supplies the Ledger Stax devices for Ledger Enterprise. Each device is attested for one Workspace before it ships.

To order new devices, open a support request in the Ledger support portal. See [**Contacting Ledger support**](/help-center-v2/contacting-support.md). The support request must give:

* the number of Ledger Stax devices;
* the name of the Workspace that the devices must be attested for;
* the recipient's full name, complete postal address, email address and phone number.

## The steps of a device action

Every action that uses the device goes through the same first four steps. The interface shows one screen for each step. The last two screens show only when you create or approve a Request.

| Screen                      | What to do                                                                        |
| --------------------------- | --------------------------------------------------------------------------------- |
| **Unlock your device**      | Unlock the device with your PIN                                                   |
| **Open the Vault app**      | Open the Ledger Vault app on the device                                           |
| **Preparing your device**   | Wait                                                                              |
| **Continue on Ledger Stax** | Read the details on the device screen. Then confirm or decline on the device      |
| **Finalizing approval**     | Wait while the platform records your approval                                     |
| **Canceling approval**      | Wait. This screen shows when you decline on the device while you create a Request |

You can close the **Login** dialog while it waits for you to unlock the device or to open the app. In every other action, the dialog stays open until the steps end or fail.

## When an update is required

The action stops when the Ledger Vault app does not open, or when its version is not the required version. The interface then shows **Update required on your device**.

1. Select **Start update**. A Ledger page for device updates opens in a new browser tab.
2. Follow the instructions on that page. See [**On the update page**](#on-the-update-page).
3. Go back to the Ledger Enterprise tab.
4. Select **Retry**.

The **Login** page also has a link to update your device: **Ensure your Ledger Stax is up to date**. Both links open the same page, at [onboarding.enterprise.ledger.com/update](https://onboarding.enterprise.ledger.com/update). You can open it at any time.

### On the update page

The page is titled **Update your Ledger device and install the Ledger Vault app**. It updates the device firmware first. It then installs the required version of the Ledger Vault app.

**Before you start:**

* Connect only one Ledger device to the computer.
* Turn on the device, and unlock it.
* Close the Ledger Vault app on the device. The firmware check needs the device on its home screen.

**To update the device:**

1. Select **Verify my device**.
2. Select **Check firmware version**. If the browser asks you to choose a device, select your Ledger device.

If a newer firmware exists, the page shows **Firmware update available**, with the installed version and the new version. Do these steps:

1. Select **Download update**.
2. If the page shows **Allow manager**, allow the Ledger manager on the device.
3. When the page shows **Accept update**, accept the update on the device.
4. Wait while the device restarts. The page shows **Device is restarting...**.
5. If the device asks for your PIN, enter it.
6. Select **Continue**. If the device shows "Update mode", select **Continue** at once.

The page then checks the firmware again. It can show **Finalizing update...** while it completes the update.

When the firmware is up to date, the page checks the version of the Ledger Vault app. It shows **Checking Vault app version...**.

1. If the Ledger Vault app is installed, open it on the device.
2. If the page shows **Device is up-to-date.** and the firmware version, select **Install Vault app**. The page shows **Installing Vault app...** and the progress.

The update is complete when the page says that the device is fully ready, and shows **Firmware & Vault app ready.**

* If you opened the page with **Start update**, select **Go back**.
* If you opened the page from the **Login** page, select **Close**.

If the required version of the Ledger Vault app is already installed, the page goes directly to this last screen.

**Errors on the update page.** Each error screen has a **Retry** button. **Retry** starts the check again from **Check firmware version**.

| Message                                                  | Cause                                                                 | What to do                                                      |
| -------------------------------------------------------- | --------------------------------------------------------------------- | --------------------------------------------------------------- |
| **An action is required**                                | The Ledger Vault app is open during the firmware check                | Close the Ledger Vault app on the device. Then select **Retry** |
| **Unlock your Ledger device**                            | The device is locked                                                  | Unlock the device. Then select **Retry**                        |
| **Connect exactly one Ledger device**                    | More than one Ledger device is connected                              | Disconnect the other Ledger devices. Then select **Retry**      |
| A message that the Ledger Stax firmware is not supported | Ledger Enterprise does not support the firmware version on the device | The message tells you to contact your technical account manager |
| **Error**, with the error name in some cases             | Another error. The screen shows its description                       | Select **Retry**. If the error shows again, contact support     |

## What it shows you

The device has its own screen, and what appears there is read from the secure hardware rather than from your browser. When you approve an operation, the recipient, the amount, and the operation type shown on the device are the ones that will actually execute.

**Read them there.** This is what makes the whole model work: see [**The security model**](/help-center-v2/concepts/the-security-model.md).

> **Important:** If the details on the device do not match your screen, decline on the device. Do not retry. Contact [**Ledger support**](/help-center-v2/contacting-support.md).
>
> As an Approver, also select **Reject** in the interface. Declining on the device does not reject the Request. It only interrupts your approval, and the interface shows **Request approval interrupted**. The Request stays pending, and other Approvers can still approve it.
>
> As the Creator, declining on the device while you create a Request is different: the platform rejects the new Request. See [**Declining on the Ledger device**](/help-center-v2/guides/requests.md#declining-on-the-ledger-device).

## Handling it safely

* **Keep it physically secure.** Someone holding your unlocked device can act as you, within your role and your approval rights.
* **Never share your PIN**, and never enter it anywhere other than on the device itself. Nobody at Ledger will ask for it.
* **Keep your recovery sheet offline and separate from the device.** Anyone with it can reconstruct your access. See [**Your recovery sheet**](#your-recovery-sheet).
* **Disconnect when you are done**, particularly on shared machines. To end your session in the interface, select **Disconnect** in the menu under your name. See [**Signing in and out**](/help-center-v2/start-here/get-started/signing-in.md#sign-out).

> **Warning:** Nobody legitimate will ever ask for your PIN or your recovery phrase, by email, chat, phone, or a web page. Any such request is an attack, whatever it appears to come from.

The practices that Ledger recommends for devices, PINs, recovery sheets and workstations are in [**Security good practice**](/help-center-v2/concepts/security-good-practice.md).

## Your recovery sheet

Your recovery sheet holds the 24-word recovery phrase of your Ledger device.

Ledger Stax devices for Ledger Enterprise are attested for a Workspace. To recover your device, you restore the 24 words on a Ledger Stax that is attested for your Workspace. After a recovery from the 24 words, the restored Ledger Stax keeps the same device ID.

* **Keep your recovery sheet.** This applies to every PSD user, Operators included. Without it, you cannot recover your device on an attested Ledger Stax.
* **Store it offline**, in a physical safe. [**Security good practice**](/help-center-v2/concepts/security-good-practice.md#recovery-sheets-by-role) gives the storage that Ledger recommends for each role.

## Your device and the Workspace partition

Each Workspace has its own partition in the Hardware Security Module (HSM). When you register, the platform connects your Ledger device to the partition of your Workspace.

* A Ledger device that is connected to another partition cannot complete a registration. The registration stops with **Device already connected to another partition**. The message tells you to disconnect the device in the Ledger Vault app settings, or to contact your Administrator.
* The connection is stored on the device. Each time you create or approve a Request, the platform checks it first. If the device has no connection, the platform connects it again to your Workspace partition. No action is necessary.
* The platform connects again only the Ledger device that is registered for your user.

## If something is wrong

<table><thead><tr><th width="293.859375">Situation</th><th>What to do</th></tr></thead><tbody><tr><td>The browser does not detect the device</td><td>Check it is connected and unlocked, then reload. Try another cable or port before concluding it has failed</td></tr><tr><td>The browser does not detect the device on a Linux computer</td><td>Install the udev rules for Ledger devices. See <a href="#connecting-on-linux">Connecting on Linux</a></td></tr><tr><td>The interface shows <strong>Update required on your device</strong></td><td>Update the Ledger Vault app. See <a href="#when-an-update-is-required">When an update is required</a></td></tr><tr><td>Another message shows when you sign in or use the device</td><td>See <a href="/help-center-v2/reference/statuses-and-errors.md#sign-in-and-device-messages">Sign-in and device messages</a></td></tr><tr><td>You cannot remember your PIN</td><td>Contact your Administrator. Do not keep guessing</td></tr><tr><td>The device is lost or stolen</td><td>Tell your Administrator <strong>immediately</strong>. A Master Administrator can suspend an Operator or an API user at once, with no Request. A Master Administrator cannot be suspended. Revoking any user needs an approved Request</td></tr><tr><td>The device is damaged</td><td>Contact your Administrator to arrange a replacement and re-registration. New devices are ordered from Ledger. See <a href="#ordering-ledger-stax-devices">Ordering Ledger Stax devices</a></td></tr></tbody></table>

Losing the device does not put your organization's assets at immediate risk, because approval quorums mean one device is rarely sufficient on its own. It still needs reporting at once.

### Connecting on Linux

The Ledger Enterprise interface and the update page connect to the Ledger device through WebHID, the browser interface for USB devices. On Linux, the browser can use the device only when udev rules give it access.

Ledger publishes these rules in the [LedgerHQ/udev-rules](https://github.com/LedgerHQ/udev-rules) repository (checked on 9 October 2026). Its script writes the rules to `/etc/udev/rules.d/20-hw1.rules` and reloads them. The script needs root rights.

1. Disconnect the Ledger device.
2. Open a terminal.
3. Run this command:

   ```bash
   wget -q -O - https://raw.githubusercontent.com/LedgerHQ/udev-rules/master/add_udev_rules.sh | sudo bash
   ```
4. Connect the Ledger device, and unlock it.
5. Reload the Ledger Enterprise page.

## Related

* [**Orientation**](/help-center-v2/start-here/get-started.md)
* [**Signing in and out**](/help-center-v2/start-here/get-started/signing-in.md)
* [**The security model**](/help-center-v2/concepts/the-security-model.md)
* [**Security good practice**](/help-center-v2/concepts/security-good-practice.md)
* [**How governance works**](/help-center-v2/concepts/how-governance-works.md)
* [**One-year limited warranty**](/help-center-v2/reference/warranty.md)
* [**Contacting Ledger support**](/help-center-v2/contacting-support.md)

## Setting up your device for the first time

To be completed.

> **Editorial note (remove before publishing):** Cover the sequence for a new user: registration link, activation, PIN setup, and pairing with the Workspace. Also list the device models supported.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.enterprise.ledger.com/help-center-v2/start-here/get-started/your-device.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.