Set Up Security Keys Without Creating a Lockout

Matthew Leo · Published September 5, 2026 · Guides

A hardware security key is one of the best ways to stop account phishing. It can also create a very physical failure: the tiny object protecting your account gets lost, damaged or left in the wrong bag.

The safe setup is not “buy a key and turn it on.” It is two tested keys, stored in separate places, plus a recovery method that you have verified before an emergency.

Start with the failure plan

Decide what happens if your everyday key disappears tonight. Can you reach a second key? Is another trusted device still signed in? Does the account permit backup codes or a different second step? The answer varies by service.

Apple requires at least two FIDO-certified keys when enabling Security Keys for an Apple Account. Google supports security keys and recommends adding other ways to prove your identity; its recovery process can take three to five business days if you lose the key and have no other second step.

Choose connectors for every device you actually use

A key can support the right security standard and still be awkward on your hardware. USB-C and NFC cover many current phones, tablets and computers. Older machines may need USB-A or an adapter. Some older iPhones use Lightning.

For Apple Accounts, Apple says the keys must be FIDO certified and compatible with the devices you regularly use. All signed-in devices must run iOS 16.3, iPadOS 16.3, macOS Ventura 13.2 or later, and iCloud for Windows needs version 15 or later. Older devices that cannot be updated may block the switch.

For a Google passkey stored on a physical key, the key must support FIDO2. A FIDO1 or FIDO2 key can still work as a second step, according to Google's documentation.

Register both keys in the same sitting

1. Update the devices and browsers you plan to use.
2. Sign in from a trusted device and open the account's security settings.
3. Add the everyday key and give it a useful name, such as “USB-C NFC daily.”
4. Add the backup key before signing out.
5. Confirm that both appear in the account's list of registered sign-in methods.
6. Record which accounts use each key without storing passwords beside the inventory.

Do not store both keys on the same key ring. One lost bag should not remove the original and the backup at once.

Test the plan, not just the setup screen

Open a private browser window or use a device where the account is not already trusted. Sign in once with the everyday key, sign out, then repeat with the backup. Test every connector or NFC path you expect to use.

Google warns that a newly enrolled key may need up to seven days before it works at sign-in in some cases. Discovering that delay while locked out would be spectacularly bad timing.

Also confirm your non-key recovery options. If the provider issues backup codes, generate a current set and store it away from your phone. Mapletechie's guide to storing backup codes safely explains why a screenshot in the same device is not much of a backup. For the wider set of accounts, build an account recovery kit.

If a key is lost

1. Use the backup key, another trusted device or another approved second step to sign in.
2. Remove the missing key from every account where it was registered.
3. Check recent account sessions and security alerts.
4. Register and test a replacement backup before the situation becomes normal again.

If a PIN-protected key becomes locked after repeated incorrect attempts, understand that resetting the key usually erases the credentials stored on it. Verify that another sign-in path works before resetting anything.

The strongest security setup is not the one with the most hardware. It is the one that remains secure when one piece fails. Two keys, two locations and one rehearsed recovery path is the practical minimum.

Tags: security keys, FIDO, two-factor authentication, account security

Read on Mapletechie