ActiveState 2FA: how to set up an authenticator app

Your ActiveState Platform account is what you sign in with to build runtimes, use the State Tool on the command line, and reach your organization's private projects. ActiveState offers two-factor authentication (2FA) as an option for accounts that sign in with a password. Its documentation describes one method, a 6-digit code from an authenticator app, and it doesn't make 2FA mandatory. ActiveState's docs name Google Authenticator and Authy as examples but say any similar app that reads QR codes will do (ActiveState). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the ActiveState steps come from ActiveState's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on an ActiveState account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: how you sign in matters

ActiveState accounts can be created with an email address and password, or with a GitHub account (ActiveState). The 2FA described here is ActiveState's own, used together with your ActiveState password. ActiveState's docs don't say whether it applies when you sign in with GitHub. In that case GitHub's own security settings protect the sign-in.

Companies can also connect the Platform to their own single sign-on, through ActiveState support or an account manager. If your organization does that, ask your IT team how 2FA works for you.

Turn on 2FA with an authenticator app

ActiveState's documentation gives these steps (ActiveState):

1. Sign in to the ActiveState Platform. Open the menu at the top right, the one that shows your username, and select Account Settings.
2. Click Two-factor Authentication, then Enable.
3. ActiveState shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on your iPhone's own screen, take a screenshot and tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. Type the 6-digit code from Novaz into the text box and click Confirm.

If the code is accepted, 2FA is on.

ActiveState's docs only describe scanning the QR code. They don't mention a text key you could type instead. If you do see one, add it in Novaz with +, then Enter key manually, putting it in the Setup key field. See What is a 2FA setup key?

When ActiveState asks for a code

According to ActiveState, once 2FA is on you need your password and the current code from your app each time you sign in. The docs don't describe a way to trust a device and skip the code (ActiveState).

The State Tool

Running state auth opens your browser to the Platform sign-in page, so you enter the code there as usual (ActiveState). If you sign in with your username and password as command-line flags instead, the command reference lists a --totp flag for the code from your app, and it only works together with the username and password flags (ActiveState).

For CI/CD pipelines, ActiveState recommends an API key saved in the ACTIVESTATE_API_KEY environment variable, which you can make with state export new-api-key (ActiveState). That way your build server doesn't need a code from your phone.

No backup codes in the docs

ActiveState's documentation doesn't mention backup or recovery codes, and it doesn't describe a second 2FA method. Novaz keeps its keys on your iPhone, so unless you turn on iCloud backup or export a backup file in Settings › Backup, that iPhone is the only place your ActiveState codes come from. Keep it safe, and read the recovery section below before you need it. For general background, see 2FA backup codes.

If ActiveState rejects your code

ActiveState's docs don't cover rejected codes. The most common cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Also make sure you type the code before it changes. More causes are in Authenticator code not working?

Changing phones

ActiveState doesn't describe moving 2FA to a new phone. The steps it does document make a workable route: while you still have the old phone, sign in with a code, turn 2FA off under Account Settings > Two-factor Authentication, then turn it on again and scan the new QR code with the new phone. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead; without one, this is the way to do it. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

ActiveState's documentation doesn't describe what to do if you lose the phone with your codes. It doesn't say what proof support asks for or how long a reset takes. Turning 2FA off yourself starts with signing in with a code, so that doesn't help once the phone is gone (ActiveState). Don't count on a password reset either: ActiveState's password page doesn't say it turns off 2FA (ActiveState).

The support contact ActiveState gives for account matters is support@activestate.com, for example for changing your account's email address (ActiveState). That's the address to write to, from the email on your account. For steps to take right away, see Lost the phone with your authenticator app?

Turning 2FA off

You can turn 2FA off at any time while you can still get codes. Sign in with your code, open Account Settings from the username menu, click Two-factor Authentication, then Disable. ActiveState won't ask for a code at your next sign-in (ActiveState). In Novaz, open the ActiveState account and tap Remove account.

Official ActiveState help

• Configure SSO and 2FA
• Create an account
• Authentication
• Command Reference
• Use the State Tool in Your CI/CD Environments
• Password Management
• Manage Your Account