Yubikey
This article describes how Yubico's YubiKey works and how you can use it.
To access the yubikey as user add the following udev rules to your configuration.nix:
services.udev.packages = [ pkgs.yubikey-personalization ];
To use the smart card mode (CCID) of Yubikey, you will also need the PCSC-Lite daemon:
services.pcscd.enable = true;
In order to manage OTP keys you can install the yubioath-desktop
package in your profile.
This application will also both the udev rules as well as pcscd enabled.