sudoforge: i enrolled the yubikey when using disko. It did not create a receovery password. How can i open the disk manually using yubikey? This fails:

root@portable ~ [1]# cryptsetup open /dev/nvme0n1p2 --fido2-device=auto cryptdisk
Usage: cryptsetup [-?VqrvyN] [-?|--help] [--usage] [-V|--version]
        [--active-name=STRING] [--align-payload=SECTORS] [--allow-discards]
        [-q|--batch-mode] [--cancel-deferred] [-c|--cipher=STRING] [--debug]
        [--debug-json] [--decrypt] [--deferred] [--device-size=bytes]
        [--disable-blkid] [--disable-external-tokens] [--disable-keyring]
        [--disable-locks] [--disable-veracrypt] [--dump-json-metadata]
        [--dump-volume-key] [--encrypt] [--external-tokens-path=STRING]
        [--force-password] [--force-offline-reencrypt] [--force-no-keyslots]
        [-h|--hash=STRING] [--header=STRING] [--header-backup-file=STRING]
        [--hotzone-size=bytes] [--hw-opal] [--hw-opal-factory-reset]
        [--hw-opal-only] [--init-only] [-I|--integrity=STRING]
        [--integrity-inline] [--integrity-key-size=BITS]
        [--integrity-legacy-padding] [--integrity-no-journal]
        [--integrity-no-wipe] [-i|--iter-time=msecs] [--iv-large-sectors]
        [--json-file=STRING] [--keep-key] [--key-description=STRING]
        [-d|--key-file=STRING] [-s|--key-size=BITS] [-S|--key-slot=INT]
        [--keyfile-offset=bytes] [-l|--keyfile-size=bytes]
        [--keyslot-cipher=STRING] [--keyslot-key-size=BITS] [--label=STRING]
        [--link-vk-to-keyring=STRING] [--luks2-keyslots-size=bytes]
        [--luks2-metadata-size=bytes] [--new-keyfile=STRING]
        [--new-keyfile-offset=bytes] [--new-keyfile-size=bytes]
        [--new-key-description=STRING] [--new-key-size=BITS]
        [--new-key-slot=INT] [--new-token-id=INT]
        [--new-volume-key-file=STRING] [--new-volume-key-keyring=STRING]
        [-o|--offset=SECTORS] [--pbkdf=STRING]
        [--pbkdf-force-iterations=LONG] [--pbkdf-memory=kilobytes]
        [--pbkdf-parallel=threads] [--perf-high_priority]
        [--perf-no_read_workqueue] [--perf-no_write_workqueue]
        [--perf-same_cpu_crypt] [--perf-submit_from_crypt_cpus]
        [--persistent] [--priority=STRING] [--progress-json]
        [--progress-frequency=secs] [-r|--readonly]
        [--reduce-device-size=bytes] [--refresh] [--resilience=STRING]
        [--resilience-hash=STRING] [--resume-only] [--sector-size=INT]
        [--serialize-memory-hard-pbkdf] [--shared] [-b|--size=SECTORS]
        [-p|--skip=SECTORS] [--subsystem=STRING] [--test-args]
        [--test-passphrase] [-t|--timeout=secs] [--token-id=INT]
        [--token-only] [--token-replace] [--token-type=STRING]
        [--tcrypt-backup] [--tcrypt-hidden] [--tcrypt-system]
        [-T|--tries=INT] [-M|--type=STRING] [--unbound] [--use-random]
        [--use-urandom] [--uuid=STRING] [--veracrypt] [--veracrypt-pim=INT]
        [--veracrypt-query-pim] [-v|--verbose] [-y|--verify-passphrase]
        [--volume-key-file=STRING] [--volume-key-keyring=STRING]
        [-B|--block-size=MiB] [-N|--new] [--use-directio] [--use-fsync]
        [--write-log] [--dump-master-key] [--master-key-file=STRING]
        [OPTION...] <action> <action-specific>
--fido2-device=auto: unknown option

1. luksDump to actually verify that you only have the fido2 token
2. throw a --token-only on your cli

1. luksDump to actually verify that you only have the fido2 token as a key
2. throw a --token-only on the cryptsetup-open command

1. luksDump to actually verify that you only have the fido2 token as a key
2. throw a --token-only on the cryptsetup-open command; this tells cryptsetup to not ask for a passphrase and instead use tokens

1. luksDump to actually verify that you only have the fido2 token as a key
2. throw a --token-only on the cryptsetup-open command; this tells cryptsetup to not ask for a passphrase and instead use enrolled tokens