Appfigures 2FA: how to set up an authenticator app

Appfigures is where app developers and publishers track downloads, revenue, reviews and app store rankings. Its two-factor authentication (2FA) is optional and works on every plan, the free one included. The only method its help page describes is a time-based code from an authenticator app (Appfigures). Two things stand out before you start: your recovery codes are the only documented way back in if you lose the app, and scripts that use basic authentication with the Appfigures API will need a personal access token instead.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Appfigures steps come from Appfigures' own knowledge base, linked below, which we read on October 21, 2026. We haven't tested them on an Appfigures account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

• Switch to the new look. If you can't find a Security section, you're on the older Appfigures look. Turning on 2FA needs the new one: open your Profile and check the box next to New Look. Appfigures says you can switch back once 2FA is on (Appfigures).
• Verify your email if you haven't. The setup sends you an email code first if your address isn't verified yet. You can do this ahead of time with the Verify link under your email address in your Profile.
• Update your API scripts. Once 2FA is on, the API requires a personal access token rather than basic authentication. Appfigures explains how to make one in How to Generate a Personal Access Token (PAT).

Turn on 2FA with an authenticator app

The steps below follow Appfigures' article, last updated October 9, 2026 (Appfigures):

1. Go to Manage > Security.
2. Under Two-Factor Authentication, click Enable.
3. If your email address isn't verified, enter the code Appfigures emails you.
4. If Appfigures asks, enter your password.
5. Appfigures shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
6. If you can't scan it, click can't scan QR code? to get a key for manual setup. In Novaz, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
7. Type the code from Novaz into the box in Appfigures and click next.
8. Save and download your recovery codes, then click I saved these codes.

Appfigures' article doesn't say how many digits its codes have or how often they change. Scanning the QR code is the safer route, because it passes those settings to your app.

Your recovery codes are the backup

Appfigures calls the recovery codes "the only way to recover your account" if you lose access to your authenticator app (Appfigures). If you haven't made a Novaz backup, or added Appfigures after your last backup file, these codes are your only fallback. Keep them away from the phone, for example in a password manager or printed out. Appfigures' article doesn't say how many codes you get or whether you can make new ones. More in 2FA backup codes.

When Appfigures asks for a code

You'll need a code from Novaz each time you log in, and also when you (Appfigures):

• change your email address or password,
• add, update or remove API keys, or
• add, update or remove users on the account.

A forgotten password doesn't get around it either. Resetting your password asks for the code from your authenticator app before you can set a new one (Appfigures).

If Appfigures rejects your code

Appfigures' help doesn't cover rejected codes. The most common cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Moving to a new iPhone

Appfigures doesn't describe a way to move 2FA to another phone. With Novaz, you can restore your accounts on the new iPhone from iCloud backup or a backup file, and the codes keep working. Without a backup, while you can still sign in with the old phone, the practical route is to turn 2FA off in Security, then turn it on again and scan the new QR code with Novaz on the new iPhone. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your recovery codes. Appfigures' 2FA article names no other route, and doesn't describe a support process for resetting 2FA or what proof you'd need. For anything else, Appfigures' contact page is the general route. Once you're in, turn 2FA off and set it up again on your current phone. More in Lost the phone with your authenticator app?

Turning 2FA off

In the Security section, click disable under Two-Factor Authentication. Appfigures takes you through the verification steps once more before it turns 2FA off (Appfigures). In Novaz, open the Appfigures account and tap Remove account.

Official Appfigures help

• Enabling Two-Factor Authentication (2FA) in Appfigures
• How Do I Reset My Password?
• How to Generate a Personal Access Token (PAT)