X Warns Users to Re-Enroll Security Keys Before November 10

X has announced that users who use security keys or passkeys for two-factor authentication (2FA) must re-enroll them before November 10. Failing to do so will result in users being locked out of their accounts until they re-enroll.

According to a post from X’s official Safety account, this requirement affects only those who rely on hardware-based security keys such as YubiKeys, or passkeys stored on their devices.

Who Is Affected by the X Security Keys Change

The update applies exclusively to users who use phishing-resistant 2FA methods, such as hardware keys or passkeys. These tools help verify a user’s identity using cryptographic keys securely stored in a device or operating system. Unlike passwords or SMS codes, they cannot be easily stolen through phishing or malware.

X officially stated; “By November 10, we’re asking all accounts that use a security key as their two-factor authentication (2FA) method to re-enroll their key to continue accessing X.”

How to Re-Enroll Your Security Keys or Passkeys

Users can either re-enroll their existing security key or register a new one. However, X warned that enrolling a new key will automatically deactivate any previously registered keys unless they are also re-enrolled.

To complete the process manually, users should:

1. Go to x.com/settings/account/login_verification/security_keys
2. Disable the current security keys.
3. Re-enroll the same or new keys by following the on-screen instructions.
4. Enter their account password to verify identity.

After re-enrollment, your security keys and passkeys will be tied to the new x.com domain instead of twitter.com.

Why Re-Enrolling Is Necessary

X clarified that this change is not due to a security incident. Instead, it’s part of the company’s ongoing migration from twitter.com to x.com. Since the old security keys are connected to the twitter.com domain, they will stop working once the site is retired.

If users don’t act before November 10, their accounts will be locked until they:

• Re-enroll their existing or new security key,
• Switch to another 2FA method like an authenticator app, or
• Disable 2FA entirely (which X strongly discourages).

The Move from Twitter.com to X.com

This requirement comes as part of X’s domain transition from twitter.com to x.com, a major step in the platform’s rebranding under Elon Musk. Once the migration is complete, all authentication tools must be linked to the x.com domain to continue working properly.

The update ensures continued protection against phishing and unauthorized logins, keeping user accounts secure as the platform evolves.