If two physical security keys are enabled on an Apple account, will sign-in fall back to the trusted phone number when neither key is available? Or is a physical key or an already trusted Apple device required to verify the sign-in and add another device?
3 Answers
For adding a new device, plan on having either one of the physical security keys or a trusted Apple device available. Apple won't send a code by SMS in this setup, but notifications and approval through an already trusted device may still work.
The important distinction is that a trusted phone number isn't the backup method after security keys are turned on. However, an iPhone or Mac that's already trusted can usually approve the sign-in or help you add a new device, even if you don't currently have the keys with you.
So would every future device require one of the YubiKeys, or could an existing trusted iPhone or Mac still be used to link it?
No—once security keys are enabled, Apple doesn't use SMS verification codes as a fallback. The keys replace those codes, which is part of what makes the setup phishing-resistant. You'll need one of the registered physical keys or another trusted Apple device already signed in.
Got it—so an already trusted Mac or iPhone can still approve the process and let me add another trusted device, but the phone number itself won't be used as a fallback.