AppVeyor 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
AppVeyor is a continuous integration service that builds and tests code, mostly for Windows projects. You can sign in to it with a GitHub, Bitbucket or GitLab button, or with an AppVeyor email address and password. Two-factor authentication (2FA) belongs to that second kind of sign-in: it protects an email/password login, and the only method AppVeyor describes is a code from an authenticator app, backed by single-use recovery codes (AppVeyor). It's optional for you, unless an account you work in requires it. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the AppVeyor steps come from AppVeyor's own blog post announcing 2FA, including its screenshots, and its release notes, which we read on October 21, 2026. That post dates from November 2018 and AppVeyor hasn't published a newer help page on 2FA, so the screens may have changed since. We haven't tested the steps on an AppVeyor account. The Novaz steps are checked against the app, version 1.0.5.
The sign-in button matters
AppVeyor's 2FA only comes into play when you sign in with email and password. If you sign in with GitHub, Bitbucket, GitLab or what AppVeyor's screens call Visual Studio Team Services, AppVeyor doesn't ask for its own code. That sign-in is only as safe as your account with that service, so turn on 2FA there too (AppVeyor).
Turn on 2FA with an authenticator app
AppVeyor's announcement describes these steps (AppVeyor):
- Sign in to AppVeyor and open My profile, then the Security tab.
- Under Two-Factor authentication (2FA), click Enable 2FA.
- The page Enable two-factor authentication opens. Its first step, Scan this barcode with your auth app, shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, AppVeyor prints a text key under the QR code. In Novaz, tap +, then Enter key manually, type AppVeyor as the Service and the key as the Setup key. See What is a 2FA setup key?
- Under Enter 6-digit code from auth app, type the code Novaz shows for AppVeyor. The setup screen says these codes are 6 digits and change every 30 seconds, which matches what Novaz makes from a typed key.
- Under Save recovery codes, copy the codes before you go on.
- Click Enable 2FA.
Save the recovery codes
AppVeyor shows the recovery codes on the setup page itself, next to the button that finishes the setup. The announcement explains that each code lets you past the 2FA step once, for when your phone isn't available (AppVeyor). It doesn't describe a way to see them again or to make new ones later, so treat that page as your one chance.
Even if you back up Novaz, these codes are your way in when the phone is gone and the backup is missing or out of date, so store them in a password manager or on paper, away from the phone. More in 2FA backup codes.
Signing in afterwards
After your email and password, the login page shows a Two-factor authentication panel. Type the current code from Novaz in Authentication code and click Verify code. If you don't have your phone, the same field takes one of your recovery codes (AppVeyor).
When an account requires 2FA
An AppVeyor account admin can make 2FA mandatory. In the account's settings, the Security page has a checkbox, Require two-factor authentication for users accessing this account with email/password, saved with Update settings. If you've signed in with email and password but have no 2FA yet, AppVeyor sends you to the setup page as soon as you open that account's resources (AppVeyor).
The same page lists Allowed authentication methods. Because GitHub, Bitbucket and GitLab sign-ins skip the check, AppVeyor suggests leaving only Email/password ticked when the requirement has to hold for everyone, unless those services can be set to demand 2FA themselves. Self-hosted AppVeyor got the same feature in AppVeyor Enterprise 6.3.0, released on January 15, 2019 (AppVeyor).
If AppVeyor rejects your code
AppVeyor doesn't publish advice for rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
New phone, lost phone, or turning it off
AppVeyor's 2FA announcement doesn't explain how to move 2FA to another phone, how to switch it off, or what happens if you lose both your phone and the recovery codes. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and keep the same codes. Without one, before you give up the old phone, sign in and look on the Security tab of My profile for a way to turn 2FA off and set it up again. See How to transfer your authenticator app to a new iPhone.
If the phone is gone, sign in with a recovery code. Without one, the only contact AppVeyor lists is general email support at support@appveyor.com. Its support page aims for a reply within 24 hours on working days but says nothing specific about 2FA or what proof it asks for (AppVeyor). More in Lost the phone with your authenticator app?
