Alibaba Cloud 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Alibaba Cloud account is the main account behind the console, billing and every resource you run. Don't look for a switch called "MFA" in its settings. Alibaba Cloud has renamed the feature: the authenticator app is now the TOTP method inside a setting called Account Protection (Alibaba Cloud). Text-message codes are the other method it offers there (Alibaba Cloud).
For the main account, turning it on is your choice. Alibaba Cloud calls it highly recommended, especially for accounts with important resources (Alibaba Cloud). RAM users, the separate logins an account owner creates for a team, are a different case, covered further down. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Alibaba Cloud steps come from Alibaba Cloud's own documentation center, linked below, which we read on October 21, 2026. We haven't tested them on an Alibaba Cloud account. Its pages don't all use the same labels, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on TOTP for your Alibaba Cloud account
These steps follow Alibaba Cloud's newest Account Center pages, updated in September 2026 (Alibaba Cloud, Alibaba Cloud):
- Sign in to the Account Center with your Alibaba Cloud account and open the Security Settings page.
- In the Other Settings section, find Account Protection and click Set up.
- On the Enable Account Protection page, pick the protection scenarios you want and the TOTP verification method, then click OK.
- Verify your identity. Alibaba Cloud can send a 6-digit code to your email address, which stays valid for 15 minutes. Enter it and click OK.
- On the next page, click Next to reach the binding page with the QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the 6-digit code from Novaz on the page and click Next.
Alibaba Cloud's beginner guide, from September 11, describes the same flow with older labels: Edit in the Account Protection section, a Turn on Account Protection page, and Submit (Alibaba Cloud).
The Account Center pages only mention scanning, not a text key. Codes are 6 digits every 30 seconds, so if a key does appear, Novaz can take it: tap +, then Enter key manually. See What is a 2FA setup key?
When Alibaba Cloud asks for a code
The scenarios you choose in step 3 decide when you're asked. Alibaba Cloud's pages say the code is used when you sign in to the console and for other critical operations, but they don't list the scenarios one by one (Alibaba Cloud).
No backup codes
Alibaba Cloud's Account Center pages don't mention backup or recovery codes. When you verify your identity to change the setting, you can choose Try a different method to use your phone or email instead of the app (Alibaba Cloud). Novaz keeps its keys on your iPhone unless you turn on iCloud backup or export a backup file, so keep the account's email address and phone number current: they are your fallback.
If Alibaba Cloud rejects your code
Alibaba Cloud's MFA FAQ has its own list (Alibaba Cloud):
- Make sure your phone's clock is in sync. On iPhone: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off.
- Type the newest code, and check it's from the right account.
- If the binding page sat open a long time, the QR code may have expired. Refresh the page and scan the new one.
- Scanning the same QR code more than once can leave duplicate entries with different codes. In Novaz, open the extra entry and tap Remove account, then scan again.
Failing that, the FAQ suggests a support ticket with screenshots of the error and your phone's time. See also Authenticator code not working?
Changing phones
Alibaba Cloud says to detach the authenticator before you uninstall the app or switch phones, or you won't be able to sign in (Alibaba Cloud). While the old iPhone still works, turn off TOTP (next section), then set it up again on the new phone. If you'd rather keep TOTP attached, a Novaz iCloud backup or backup file lets you restore the account on the new iPhone with the same codes. See How to transfer your authenticator app to a new iPhone.
Turning TOTP off
In the Account Center, go to Security Settings, and in Other Settings click Modify for Account Protection. Click Turn off next to the TOTP method, or in the Account Protection Settings section to turn protection off entirely. Then enter a code from your app. If Alibaba Cloud starts a security review, approve the request from the Account Center notifications or to-do items (Alibaba Cloud).
If you lose your authenticator
First check whether another method, such as text messages, still works. If nothing does, Alibaba Cloud's route is a manual appeal (Alibaba Cloud):
- On the Alibaba Cloud home page, click Login, then Other Sign In Difficulties? at the bottom.
- Select I cannot log in (MFA/TOTP and login mask could not be verified) and click Next step.
- Complete the slider check, fill in the form with an email address and phone number you can reach now, and click Submit.
You get a Query code to track the appeal. A support engineer then contacts you to check your identity and how you pay. Have your login email and account display name ready, plus proof that depends on how you pay, such as a transaction record, or the first 6 and last 4 digits of your card. The appeal page gives no time frame. Another Alibaba Cloud page says reviews through this form typically take three business days (Alibaba Cloud). See also Lost the phone with your authenticator app?
If you sign in as a RAM user
RAM users set up their own authenticator, and Alibaba Cloud has been making MFA mandatory for them since March 17, 2025. After signing in, hover over your profile picture, click Security Information, then Bind VMFA next to MFA Device in MFA Information. That page offers the QR code and a key you can type instead (Alibaba Cloud). If you lose the device, the account owner or a RAM administrator has to unbind it for you.
