# Security Keys for Your Apple Account: Setup and Risks > Physical security keys add phishing-resistant protection to an Apple Account. Learn Apple's requirements, how to set them up and how to avoid permanent lockout. - URL: https://www.awarexone.com/research/apple-account-security-keys - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-20 - Topics: Apple, Two-factor authentication - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer With security keys on, signing in to your Apple Account on a new device needs your password plus a FIDO Certified key or a trusted Apple device. Apple requires at least two keys and up to six. Add them in Settings under Sign-in and Security, then Two-Factor Authentication. Losing every key and trusted device can mean permanent lockout. ## Summary - With keys on, signing in needs your password plus a key or a trusted Apple device. - Apple requires at least two FIDO Certified security keys and supports up to six. - You need iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later on all devices. - Setup signs you out of devices not used or unlocked in more than 90 days. - Losing every key and trusted device could lock you out of your account permanently. Most Apple Accounts use two-factor authentication with a six-digit code sent to a trusted device. That is strong, but a convincing fake website can still trick someone into typing the code. Security keys close that gap by requiring a physical key that only works with the real Apple sign-in. They also add responsibility, because Apple says losing all your keys and devices can mean you never get back in. This guide covers what Apple requires, how to set keys up and how to keep a safe margin. Last checked: 20 October 2026 against Apple Support. ## What does a security key change? Apple says a security key is a small external device that looks like a thumb drive or tag, used for verification when signing in with two-factor authentication. With keys turned on, signing in on a new device or the web needs your password plus either a security key or another trusted Apple device already signed in, and Apple says these become the only ways to sign in. Apple designed the feature for people who want extra protection from targeted attacks, such as phishing or social engineering scams ([Apple Support](https://support.apple.com/en-us/102637)). ## What do I need before I start? - At least two FIDO Certified security keys. Apple says you can add up to six. - iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later on every device you use with the account. - Two-factor authentication already set up. - A modern web browser for signing in on the web. - For Apple Watch, Apple TV or HomePod, an iPhone or iPad with software that supports security keys. Apple says NFC keys work only with iPhone, USB-C connectors work with iPhone 15 or later and most Mac models, and Lightning connectors work with iPhone 14 and most earlier iPhones. It also says child accounts and Managed Apple Accounts are not supported, and older devices that cannot be updated cannot be signed in to. ## How do I add security keys? 1. On your iPhone, open Settings and tap your name. 2. Tap Sign-in and Security, then Two-Factor Authentication. 3. Tap Security Keys, then Add Security Keys, and follow the onscreen instructions. 4. Add at least two keys. 5. Review the devices on your account and choose whether to stay signed in or sign some out. > Note: **Inactive devices are signed out.** Apple says that during setup you are signed out of inactive devices, meaning ones you have not used or unlocked in more than 90 days. To sign back in, they need compatible software and a key. ## What happens when I sign in? Apple says you need a key or another trusted Apple device to sign in on a new device or the web, to reset your password or unlock your account, and to add or remove keys. If you do not have a key with you, you can bring a trusted iPhone or iPad near the new device and follow the instructions on both. ## What are the risks? Apple says you are responsible for keeping your security keys safe, and that if you lose all trusted devices and security keys, you could be locked out of your account permanently. It suggests keeping keys in more than one place, for example one at home and one at work, and leaving one at home when travelling ([Apple Support](https://support.apple.com/en-us/102637)). | You lost | What you can do | | --- | --- | | One key, other key still available | Sign in with the other key and remove the lost one | | All keys, trusted device still available | Use the trusted device to manage or replace keys | | All keys and all trusted devices | You may be locked out permanently | ## How do I remove a lost key or turn the feature off? 1. Open Settings, tap your name, then Sign-in and Security. 2. Tap Two-Factor Authentication, then Security Keys. 3. Tap Remove All Security Keys to stop using them. Apple says that if you remove all keys, your account goes back to using six-digit verification codes for two-factor authentication. ## Combining keys with other recovery options Security keys do not replace planning for recovery. Apple also offers recovery contacts and a recovery key. A recovery key is a 28-character code that turns off standard account recovery, and Apple says it cannot provide it if you lose it ([Apple Support](https://support.apple.com/en-us/109345)). A recovery contact is a trusted person who can get a six-digit recovery code for you ([Apple Support](https://support.apple.com/en-us/102641)). Our guide to [recovery contacts and recovery keys](https://www.awarexone.com/research/apple-account-recovery-contact-and-key) compares them. ## A short checklist before you switch on keys 1. Buy two FIDO Certified keys that fit your devices. 2. Update every device to supported software. 3. Sign in on devices you want to keep, so they are not signed out as inactive. 4. Keep one key at home and one elsewhere, such as at work. 5. Add a recovery contact as an extra safety net. Apple also says that to sign in to iCloud for Windows after setting up keys, you need iCloud for Windows 15 or later, and that Apple Watches paired with a family member's iPhone are not supported until you set the watch up with your own iPhone. ## Common mistakes - Keeping both keys on the same keyring. - Forgetting an older device that still needs to sign in, which may then be signed out. - Buying keys with connectors that do not fit the devices you use. - Assuming Apple can bypass security keys if you lose them all. ## Watch out for recovery scams Apple's own settings, help pages and forms are the official routes. Anyone who messages you offering to restore or unlock your account, or who asks for your password, codes or recovery details, is not part of that process. Never share them. Our guide on [spotting fake recovery services](https://www.awarexone.com/research/account-recovery-scams-how-to-spot-fake-recovery-services) lists the warning signs. ## What are the realistic limits? Apple controls Apple Account security. Security keys strengthen protection against phishing, but Apple says losing every key and trusted device could mean permanent lockout. If you lose a trusted device without keys set up, see [Apple two-factor and a lost trusted device](https://www.awarexone.com/research/apple-id-two-factor-trusted-device-lost). AwareXone helps people review account access and security through official platform routes. We are independent and not affiliated with Apple, the work is best-effort, and Apple makes the final decision. Read more about our [account security](https://www.awarexone.com/services/account-security). ### How many security keys do I need for my Apple Account? Apple requires at least two FIDO Certified keys and lets you add up to six. ### What happens to old devices when I add keys? Apple says you are signed out of devices you have not used or unlocked in more than 90 days. ### Can Apple unlock my account if I lose all my keys? Apple says if you lose all trusted devices and keys, you could be locked out permanently. ### How do I go back to verification codes? Remove all security keys in Sign-In and Security. Apple says the account then uses six-digit codes again. ## Official sources - [Apple Support, About Security Keys for Apple Account](https://support.apple.com/en-us/102637) - [Apple Support, How to generate a recovery key for your Apple Account](https://support.apple.com/en-us/109345) - [Apple Support, How to set up an account recovery contact](https://support.apple.com/en-us/102641) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.