Midway auth error opening SageMaker HyperPod Spaces

Has anyone seen the Midway authentication popup display “You're using a security key that's not registered with this website” or “This security key doesn't look familiar” when trying to open a Space in SageMaker Studio? I’ve been looking into why the new Studio‑based Space management feature sometimes fails at the authentication step and what work‑arounds exist for data scientists who prefer the visual interface over the HyperPod CLI or kubectl.
When a user navigates to the IDE and Notebooks tab on a HyperPod cluster detail page and clicks Open on a Space, Studio launches a Midway authentication window. In several reports the popup shows one of two exact error strings:

• “You're using a security key that's not registered with this website”
• “This security key doesn't look familiar”

These messages come directly from the Midway authentication service and indicate that the security key presented by the browser is not recognized as a registered device for the user’s Amazon account. The error is not related to the Space configuration itself; the underlying HyperPod EKS cluster and the Space definition remain intact. Instead, the block occurs before any request reaches the SageMaker backend, preventing the browser session from establishing the trusted channel needed to launch JupyterLab or Code Editor.
Diagnosing the issue usually starts with checking the Midway UI. If the user sees either of the above strings, the next step is to verify which security keys are registered under the account. In the Midway portal, under Registered security keys, the key that triggered the error will be absent or marked as inactive. Common causes include:

• Using a newly inserted USB security key that has not yet been registered via the Midway enrollment flow.
• A key that was previously registered but later removed or reset during a security policy update.
• A browser session that mistakenly presents a different credential (for example, a platform authenticator on a laptop that lacks the required firmware version).

Once the mismatch is confirmed, the remedy is to re‑register the key through the Midway enrollment screen or fall back to an alternative authentication method such as a time‑based one‑time password (TOTP) if the organization allows it. After the key is recognized, the Midway popup proceeds to “Authentication Successful” and the Space opens normally in the browser.
For teams that need an immediate unblock while the key issue is resolved, the original command‑line path remains available. The HyperPod CLI command aws sagemaker create-space --cluster-name <cluster> --space-name <name> (or the equivalent kubectl apply -f <space‑yaml> ) can create, start, and stop Spaces without invoking the Midway web flow. This approach bypasses the browser‑based authentication entirely and relies on the AWS CLI or kubectl credentials already configured on the workstation.
In practice, the most efficient workflow combines both methods: use Studio for routine Space management when the Midway key is registered, and keep the HyperPod CLI or kubectl handy as a fallback for authentication hiccups or for automation scripts that require non‑interactive operation. Has anyone else encountered these specific Midway messages, and did re‑registering the key resolve the problem for you? Feel free to share any additional tips for keeping the Studio‑based Space UI running smoothly.