A passkey setup loop usually looks simple: you approve Face ID, return to the website or app, and immediately see the same “create a passkey” prompt again. Repeating the prompt rarely helps. The loop normally means the iPhone saved something that the account did not accept, the account saved something the iPhone cannot use, or iOS is not handing the credential back to the app correctly.
Work through the checks below in order. They start with settings that do not remove anything, then move to deleting only the failed passkey if the two sides are out of sync.
Find where the setup stops
The moment the prompt returns tells you which side to inspect. Make one careful attempt and note what happens rather than tapping through the loop several more times.
The prompt returns before Face ID
If Face ID never appears, the app or website may not be reaching the iOS passkey sheet. Open the same account page in a normal Safari tab. If Safari offers the passkey prompt, the problem is probably the app’s embedded browser or an outdated app session.
This comparison is also useful when another service will not authenticate on an iPhone. The browser fallback in that app-versus-browser comparison helps separate an app problem from a phone-wide sign-in problem without resetting the device.
Face ID succeeds, but setup starts again
This pattern points to a registration mismatch. The iPhone may have created a local passkey while the service failed to attach its public credential to your account. It can also happen when a previously created passkey remains on the service but has been removed from the phone.
Do not delete every saved password or reset the iPhone. First confirm the storage and AutoFill settings, then compare the passkey shown in Passwords with the account’s security page.
Restore the iPhone credential handoff
Passkeys on iPhone rely on iCloud Passwords & Keychain, device authentication, and the AutoFill provider. A problem in any one of those layers can send you back to the beginning.
- Install the latest available iOS update from Settings > General > Software Update, then restart the iPhone.
- Open Settings > [your name] > iCloud > Passwords. Turn on Sync this iPhone. On older iOS versions, the path may be labeled Passwords & Keychain.
- Go to Settings > General > AutoFill & Passwords. Turn on AutoFill Passwords and Passkeys, and make sure your intended password provider is enabled.
- Confirm that the iPhone has a passcode and that Face ID or Touch ID works when unlocking the Passwords app.
If you use both Apple Passwords and a third-party password manager, temporarily leave only the provider that should store this passkey enabled. Two enabled providers are supported, but choosing a different provider during registration and sign-in can make the account appear to have no usable credential.
Open Safari in a normal tab for the next test. Private Browsing is useful for isolating cookies, but Apple notes that Safari does not save some account information there. A normal tab removes that variable while you repair registration.
Remove a stale passkey without losing the account
Only continue here if the safe settings checks did not stop the loop. Keep the account’s password, recovery email, verification method, or another signed-in device available before deleting a credential.
Inspect the saved entry first
Open Passwords, authenticate, and choose Passkeys. Search for the website or app. Check the username and domain carefully, especially if you have personal and work accounts with similar addresses.
Finding an entry does not prove registration finished on the service. It proves only that the iPhone has a private credential for that domain. In a browser, sign in with another available method and open the service’s Security, Sign-in methods, or Passkeys page. The exact label belongs to the service, not iOS.
Clean up both sides in the right order
If the service lists a passkey that does not work, remove that passkey from the service first while you are still signed in. Then return to Passwords > Passkeys, open the matching entry, tap Edit, and choose Delete Passkey.
Do not remove a working passkey used by another device. Some services list each passkey separately by creation date or device, while others show a generic name. When the identity is unclear, add a fresh recovery method or contact the service before deleting anything.
Make one clean registration attempt
After removing the failed record, close the app and the account tab. Reopen Safari, sign in with the account’s password or recovery method, and return to its security settings.
Choose Create passkey or the equivalent option once. Approve the iOS sheet with Face ID, Touch ID, or your device passcode. Wait for the website to show its own success message before leaving the page.
Then verify both sides:
- Open Passwords > Passkeys and confirm the correct account appears.
- Refresh the service’s security page and confirm it lists the new passkey.
- Sign out only after both records are visible.
- Sign in once with the new passkey.
If Safari works but the original app loops, update or reinstall that app, then sign in again. Do not delete the newly working passkey just because the app still has an expired web session.
Recognize an account-side or managed-device block
A loop that affects one service on several devices is usually not an iPhone Keychain failure. The service may have a stale server-side credential, a temporary registration error, or a policy that does not allow passkeys for your account type.
Work and school accounts add another boundary. A company can control authentication methods, require device compliance, or route registration through a managed sign-in page. If the problem appeared while adding work email, confirm the basic account and enrollment path using the mobile mail account checks before asking IT to review the permitted authentication methods.
Give support the time of your latest attempt, the app or browser used, whether Face ID appeared, and whether the new passkey showed in both Passwords and the service’s security page. Those details identify the failed side without exposing the passkey itself.
Questions before another reset
Why does Face ID finish if the passkey was not created?
Face ID authorizes the iPhone to create or use a credential; it does not confirm that the website successfully stored the matching public credential. The service must finish registration and show its own confirmation. A connection or account error after Face ID can therefore return you to setup.
Should I delete the passkey from the Passwords app?
Only delete the matching failed entry after confirming you still have another way into the account. When possible, remove the broken record from the service’s security page first. Deleting the iPhone entry alone does not remove the service’s server-side record.
Will resetting network settings fix the loop?
Usually not. A network reset removes saved Wi-Fi and related settings but does not repair a mismatched passkey record. Consider it only when registration requests fail across several unrelated services and ordinary Safari pages also have connection problems.
Can I keep using my password while this is unresolved?
That depends on the service. If it still offers a password, verification code, recovery key, or another signed-in device, keep that fallback until the new passkey works. Do not remove the last recovery method merely to force passkey setup.
The practical takeaway
Treat the loop as a two-sided registration problem, not a reason to erase the iPhone. Confirm Keychain sync and AutoFill, test the account in a normal Safari tab, and compare what Passwords shows with the service’s security page. If those records disagree, remove only the failed credential and make one clean attempt. When the same service loops on multiple devices or a managed account blocks registration, the service owner or organization must fix the account-side policy.