PSA: Re-register your hardware 2FA key for X before Nov. 10 to avoid getting locked out

Social network X said over the weekend that it plans to retire its twitter.com URL for authentication. This means users who have enabled two-factor authentication using a hardware key like YubiKey will have to re-enroll their keys before November 10.

“By November 10, we’re asking all accounts that use a security key as their two-factor authentication (2FA) method to re-enroll their key to continue accessing X. You can re-enroll your existing security key, or enroll a new one,” the social network’s safety account posted last Friday.

Two days later, the company explained that this was necessary because the company wanted to retire its old twitter.com domain. The domain change is not expected to impact other 2FA authenticators like Google Authenticator, Microsoft Authenticator, or Authy.

“To clarify: this change is not related to any security concern, and only impacts Yubikeys and passkeys – not other 2FA methods (such as authenticator apps). Security keys enrolled as a 2FA method are currently tied to the twitter[.]com domain. Re-enrolling your security key will associate it with x[.]com, allowing us to retire the Twitter domain,” the account said.

Christopher Stanley, a security engineer at X, xAI and SpaceX, said this move is to ensure domain trust. “Getting off of Twitter enrolled keys so we can stop doing hacky things for domain trust. Physical security keys are cryptographically registered to Twitter’s domain and need to be re-enrolled under X,” he said.

If you’re using a hardware key to secure your account, head to “Settings” -> “Security and account access” -> “Two-factor authentication” -> “Manage security keys”.

It is not clear if X plans to retire the twitter.com domain for all activities, or if this is just a security measure. We have asked the company to clarify, and will update the story if we hear back.