Aiven 2FA: how to set up an authenticator app

Your Aiven account is the one you use in the Aiven Console to run managed open-source data services, such as PostgreSQL or Kafka (Aiven). Aiven's two-factor authentication (2FA) asks for a code from an authenticator app on top of your password. Three things set Aiven apart. It only covers email-and-password sign-in. Turning it on or off revokes personal API tokens you created while signed in with a password. And changing your password switches it off again (Aiven, Aiven).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Aiven steps come from Aiven's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on an Aiven account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Which sign-ins it protects

Aiven lets you sign in with an Aiven password, with Google, Microsoft or GitHub, or through your organization's single sign-on (SSO). 2FA covers only the Aiven Password method: Aiven can't enforce it for third-party or identity-provider logins, so if you sign in with Google or your company's SSO, that provider's own security settings are what count (Aiven).

Organization admins can make 2FA required for password logins in their authentication policy. When they do, you can't reach any of the organization's resources until you set it up (Aiven).

Check your API tokens first

If you use personal tokens with the Aiven API, the CLI or Terraform, plan ahead. Enabling or disabling 2FA revokes the personal tokens you created with password authentication (Aiven). After setup, create new tokens and update the tools that use them. For automation, Aiven suggests an application user with its own tokens rather than personal ones (Aiven).

Turn on 2FA with an authenticator app

Aiven's documentation describes these steps in the Aiven Console (Aiven):

1. Click User information (the user icon) and select Authentication.
2. On the Aiven Password method, switch on the Two-factor authentication toggle.
3. Enter your password and click Next.
4. Aiven shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the console is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, Aiven also shows the key as a TOTP secret. In Novaz, tap +, then Enter key manually, enter Aiven as the Service, your email as the Account if you like, and paste the secret as the Setup key. See What is a 2FA setup key?
6. Back in the console, type the code from Novaz in Confirmation code.
7. Click Enable.

Aiven's documentation doesn't say how many digits its codes have or how often they change. A key typed by hand in Novaz always makes 6-digit codes every 30 seconds, so scanning the QR code is the safer choice: it carries the code settings with it.

No backup codes

Aiven's documentation doesn't mention backup or recovery codes. Its documented way back in is a password reset by email (below). So the email address on your account is your real backup: keep it secure and reachable. Novaz keys stay on your iPhone, with no other copy unless you turn on iCloud backup or export a backup file.

Changing your password turns 2FA off

Aiven's password page says 2FA is disabled when you change your password, and asks you to enable it again (Aiven). Each time you change it under User information > Authentication > Change password, go back and repeat the setup above. When you do, remove the old Aiven entry from Novaz (open it and tap Remove account) so you don't mix up two codes.

If Aiven rejects your code

Aiven's documentation doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when your clock is 15 seconds or more off. If you typed the key by hand, try setting it up again with the QR code. Other causes are in Authenticator code not working?

Changing phones

Aiven's way is to disable 2FA and enable it again on the new device (Aiven). Do this while the old phone still works. Both steps revoke personal tokens made with password sign-in. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone and skip this. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Aiven's route is a password reset (Aiven):

1. Log out of the Aiven Console.
2. Enter your login email and click Log in.
3. Click Forgot password?.
4. Enter your login email and click Reset your password.
5. Set up 2FA again with your new phone or app.

Aiven doesn't describe a support process for people who have lost access to their email as well. More in Lost the phone with your authenticator app?

Turning 2FA off

Click User information, select Authentication, switch off the Two-factor authentication toggle on the Aiven Password method, enter your password and click Disable Two-Factor Authentication (Aiven). If your organization requires 2FA, Aiven says you can't reach its resources until 2FA is set up again (Aiven).

Official Aiven help

• Aiven docs
• Manage two-factor authentication
• Change your password
• Set authentication policies for organization users
• Authentication methods