Open X’s 2FA settings
- Open Settings and privacy from X’s menu. On the website, start with More.
- Choose Security and account access → Security → Two-factor authentication.
- Select Authentication app and start enrollment.
- Enter your password and confirm your email if requested. Keep the QR-code setup open.
Add X to Sign In
X accepts standard authenticator codes. On iPhone, we recommend Sign In, our authenticator app, which generates codes on your device.
- Display X’s QR code on another screen. In Sign In, choose Add → Scan QR Code.
- Review the account details and tap Add Account.
- Return to X, continue to its verification step, and submit the current six-digit code from Sign In.
- Complete the confirmation screen and check that authentication-app protection is enabled.
If X offers a manual setup key, you can use Add → Enter Setup Key on the same iPhone. Label the Service X and Account with your username, paste the Key, and add the account. If no key is offered, use a second screen for scanning.
Security keys and SMS
A compatible hardware security key is another supported method and provides phishing resistance that typed codes do not. Keep a way to recover if that key is lost.
SMS 2FA requires X Premium, and availability varies by country and carrier. Authenticator-code setup is separate from that subscription restriction. Text messages also depend on access to your registered phone number.
Keep a backup code
Save the backup code from X’s verification setup or security settings somewhere accessible without your phone. Keep it private. If you cannot use Sign In, try that code or another authentication method you already configured.
If you have no working backup and are logged out, use X’s login-authentication help. Do not assume that knowing the password is enough to bypass the second step.
If your code does not work
Select the correct X username in Sign In, wait for a fresh code, and enter it promptly. Check automatic date and time on your iPhone if the problem continues.
A backup code and a temporary password are different. Follow X’s instructions for the particular login flow rather than substituting one for the other. If you still have a signed-in session, review your available recovery options before signing out.