Acquia 2FA: how to set up an authenticator app for your Acquia ID
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Acquia ID is the single sign-in behind Acquia Cloud Platform and its add-ons (Code Studio, Cloud IDE, Pipelines and others), Acquia Source, Acquia Web Governance and Acquia Edge Standard (Acquia). Two-factor authentication (TFA, as Acquia's docs call it) is optional for your own account, but an application's owner or administrator can switch it on for everyone who works on that application. Then it isn't optional: "TFA is mandatory to access any TFA-enabled application in Acquia" (Acquia).
Acquia ID offers two kinds of method: one mobile authenticator app that makes time-based codes, and up to 10 security keys or biometric authenticators, such as a YubiKey, Touch ID on a MacBook or Windows Hello. This guide uses Authenticator App - Novaz on iPhone for the app. Any authenticator app works the same way.
How we checked this guide: the Acquia steps come from Acquia's own product documentation, linked below, which we read on October 21, 2026, both as web pages and in the plain Markdown copies the docs site links from each page. We haven't tested them on an Acquia account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
If an application you belong to already requires TFA, Acquia asks you to set it up right after you sign in, and you can't skip it. Otherwise you add it from your profile (Acquia):
- Go to cloud.acquia.com or source.acquia.com and sign in with your email address and password.
- Select your profile icon at the top right, then Manage Account.
- In Multi-factor Authentication, select the plus icon next to the authenticator method. Enter your password and select Verify.
- Select Set up. The Set up Authenticator page shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, the same page also shows a text key. In Novaz, tap +, then Enter key manually. Put Acquia in Service, your Acquia username in Account, and the key in Setup key. See What is a 2FA setup key?
- In Enter code, type the code from Novaz and select Verify, then Continue.
Acquia then emails you that a security method was added. Its docs don't give the code length or interval, so scan the QR code if you can: it carries those settings to the app.
If you're an owner or administrator and want TFA for the whole team, open the application in Cloud Platform, select Security, then Edit settings. On Edit Security Settings, set Two-step verification to Enabled and select Save (Acquia).
No backup codes, so add a second method
Acquia ID's documentation doesn't mention backup or recovery codes, and you can register only one mobile authenticator. Novaz keeps its keys on your iPhone, so unless you've made a Novaz backup (iCloud backup or a backup file), a lost phone would leave you with no second way in. The fix Acquia does offer: under Multi-factor Authentication, also add a security key or a passkey on your computer (Security Key or Biometric Authenticator).
When Acquia asks for a code
You enter a code each time you sign in to an Acquia ID product. Acquia's products also ask you to sign in again once 90 minutes have passed since your last sign-in (Acquia).
The authenticator also works for account self-service. When you choose Reset Password or Unlock account on the sign-in page, you can pick Authenticator and prove it's you with a code instead of an email link.
If Acquia rejects your code
Acquia's docs don't cover rejected codes. Start with the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. More causes are in Authenticator code not working?
Too many failed sign-ins can lock the account, and Acquia emails you about it. To get back in, choose Unlock account on the sign-in page, then either Send me an email or the Authenticator option (Acquia).
Changing phones
Acquia doesn't describe a phone switch. With only one authenticator allowed, you delete it and add the new one. Deleting a method asks you to verify with that same method, so do it while the old iPhone still works: Manage Account > Multi-factor Authentication, select the delete icon, enter your password, select Verify, and enter a code. Then add the authenticator again with the new phone. If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone and skip the delete-and-add. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use your security key or passkey if you added one. If not, Acquia's help says a member of your team must open a ticket with Acquia Support, and that Support won't restore account access over the phone (Acquia). It doesn't say what proof Support asks for or how long a reset takes. More in Lost the phone with your authenticator app?
Turning 2FA off
Use the delete steps under "Changing phones" (Acquia). If an application you use requires TFA, you'll be asked to set it up again.
Other Acquia sign-ins
- Company SSO: if your organization has set up Acquia Single Sign-On for your email domain, you sign in with your company's identity provider instead of Acquia ID credentials, and its rules apply (Acquia).
- Site Factory: the Site Factory Management Console has its own two-factor setup, with recovery codes, under the Security tab of your account (Acquia).
