X.com YubiKey Login Issue: Why Users Can't Access Their Accounts

Update (November 12, 2025 - 20:25 UTC): The YubiKey re-enrollment issue appears to be resolved. Users are reporting successful logins with their security keys and passkeys. If you're still experiencing issues, the workaround below using your recovery key should still work.

If you tried logging into X.com today and hit the "You must re-enroll your YubiKey" message—you're not alone. Data from DownDetector shows a significant spike in login issues, with approximately 70% of reports related to authentication failures affecting users with hardware security keys and passkeys.

Here's what happened and how to fix it if you're still affected.

How to Fix the yubikey login loop: Use Your Recovery Key

Here's what works to regain access:

Step 1: Log in with your recovery key

1. Cancel any passkey login prompt
2. Choose "Login with Recovery key"
3. Enter the recovery key you saved when setting up 2FA

Step 2: Disable passkeys temporarily

Once you're back in your account:

1. Go to "Settings & Privacy" under "More"
2. Select "Security and Account Access"
3. Click "Security"
4. Go to "Two-factor authentication"
5. Make sure "Security Key" is not selected
6. Verify with your password
7. This prevents the re-enrollment loop from locking you out again

The Problem: Stuck in the Re-Enrollment Loop

Many X.com users who rely on YubiKeys, passkeys, or other hardware security keys for two-factor authentication are experiencing a frustrating catch-22:

• You enter your username and password correctly
• X.com prompts for your YubiKey or passkey
• Instead of granting access, you see: "You must re-enroll your YubiKey"
• But you can't access account settings to re-enroll because you're not logged in

This affects users with passkeys (YubiKey, 1Password, and other password managers) across multiple geographies. The problem persists even after attempting to re-enroll, creating an infinite loop that prevents account access.

Why This Is Happening: The Twitter.com Domain Phase-Out

The root cause is X.com's migration away from the twitter.com domain. Hardware security keys and passkeys use WebAuthn/FIDO2 standards, which are domain-bound—registered against a specific domain. Keys registered under twitter.com no longer work with x.com's authentication system.

X's official Safety account confirmed this transition:

According to X Safety, accounts should only be locked until re-enrollment completes. However, many users report being stuck in a re-enrollment loop even after following the prompts:

This suggests a backend synchronization issue where the system continues to flag accounts as having credentials tied to the old domain, even after re-enrollment attempts.

Key Takeaways

1. This is not your fault—it's a platform-wide authentication issue related to domain migration, not user error or device problems.
2. Use your recovery key to bypass the re-enrollment loop and regain access to your account.
3. Temporarily disable Security Key 2FA after logging back in to prevent getting locked out again.
4. Don't click on unexpected email links claiming to help with YubiKey re-enrollment—phishing risk is heightened during platform issues like this.

Protect Your Social Media Presence

Whether X resolves this in hours or days, it’s a good reminder: your social accounts and online assets are valuable and can be temporarily unavailable without notice. Screenshot important posts, testimonials, analytics, and social proof in multiple locations. With PostCapture, you can create high-quality branded screenshots and back up your content—ideal for creators and businesses.

Try PostCapture free (no signup required for basic screenshots) or upgrade for watermark-free exports and more screenshots per month.

Have you been affected by this issue? Share your experience in the comments below or contact us at [email protected].

Article last updated: November 12, 2025 - 20:25 UTC