Meta Asks You to Create a Passkey: What It Means

If Facebook, Instagram, Messenger or Threads tells you that you must create a passkey before you can continue, the message is usually linked to Meta's Advanced Protection. Meta says some accounts are required to create a passkey, and that if you do not, you will be locked out until you do. This guide explains what a passkey is, which accounts Meta says are affected, how to create one and what to check when it does not work.

Last checked: 20 October 2026 against the Meta Help Center.

#What is a passkey?

Meta describes passkeys as an alternative to passwords that lets you sign in or re-verify with your fingerprint, face scan or device screen lock. It says passkeys cannot be stolen, shared, guessed or reused like passwords, because they are stored securely on your device, and that if you use a fingerprint or face scan, the biometric data stays on your device and is not shared with Meta (Meta Help Center).

The FIDO Alliance, which publishes the standards passkeys are built on, describes a passkey as a sign-in credential stored on your phone, computer or a hardware security key, and says passkeys are designed to resist phishing (FIDO Alliance).

#Why is Meta making me create one?

Meta says accounts enrolled in Advanced Protection are required to create a passkey. It describes Advanced Protection as helping defend accounts that may be at higher risk of phishing, including but not limited to (Meta Help Center):

• Accounts with access to advertising or business tools
• Accounts connected to Pages or profiles with many followers or wide reach
• Accounts connected to businesses that advertise with Meta, such as Page admins or people added to a Business Portfolio
• Creators and businesses subscribed to Meta Verified
• Civic actors such as politicians and journalists

#How do I create a Meta passkey?

Meta says you may be prompted to create a passkey when signing in, or you can set one up manually on iPhone, Android or a computer (Meta Help Center):

1. Go to settings in the Meta app you are using.
2. Tap or click Meta Account Settings.
3. Tap or click Login and security.
4. Tap or click Passkey, then Create passkey.

Meta says not to create a passkey on a public or shared device. You can create up to five passkeys per Meta Account, and each shows the linked email or phone number, where it is stored and when it was created.

#What if passkey creation fails?

Meta lists these requirements and checks (Meta Help Center):

• Update the app to the latest version.
• Turn on your device screen lock.
• On Apple devices, turn on iCloud Keychain.
• Turn on Bluetooth if you are using a phone's passkey to sign in on a computer.
• Leave Incognito or private browsing mode, where passkeys may not work.

If you are signing in on a new device, Meta says you may see a QR code that you can scan with your phone to sign in, with Bluetooth on for both devices.

#Should I remove a passkey I no longer use?

Meta says removing a passkey is permanent, and that if your account requires a passkey for Advanced Protection, removing it may cause you to lose access until you create a new one. Check you have another working passkey before removing one, and remember you may also need to delete it from your device or password manager separately.

#Common mistakes

• Creating a passkey on a shared office or family computer.
• Removing your only passkey on an account that requires one.
• Using Incognito or private browsing, where Meta says you may be unable to create or use passkeys.
• Ignoring the prompt on a business admin account until the account is locked.

#Watch out for passkey scams

Real passkey prompts appear inside Meta's apps and in Meta Account Settings. Be wary of messages or emails with links asking you to set up a passkey or verify your account elsewhere, and never share your password or login codes with anyone. Our guide on spotting fake recovery services lists common warning signs.

#Synced or device-bound: which passkey do I have?

Meta describes two types of passkey. Synced passkeys are available on any device where you are signed in to a cloud service such as iCloud Keychain or Google Password Manager. Device-bound passkeys can only be used on the device they were created on and cannot leave it (Meta Help Center).

This matters if you change or lose your phone. A synced passkey should follow you to a new device signed in to the same cloud account. A device-bound passkey stays on the old device. If your account requires a passkey, it is sensible to create a second one on another device you own, such as a laptop, while you still have access, since Meta allows up to five.

Meta also says it may automatically upgrade existing saved credentials to passkeys when you sign in using password autofill. It says this does not change how you log in and only stores a passkey for faster access next time. You can turn this off with the Allow Automatic Passkey Upgrades setting in your device password settings.

#What are the realistic limits?

Meta decides which accounts are enrolled in Advanced Protection and how passkeys are required. Passkeys reduce some risks, but they do not replace other good habits such as securing the email account linked to your profile and reviewing who has admin access to your Pages. Our guides on two-factor authentication and protecting business social accounts cover those steps.

AwareXone helps people and businesses review account security through official platform settings. We are independent and not affiliated with Meta, the work is best-effort, and Meta makes the final decision on account access. Read more about our account security support.