Appwrite 2FA: how to set up an authenticator app for your Console account

Appwrite has two kinds of multi-factor authentication (MFA), and it's easy to land on the wrong page. One is a feature you build into your own app for your users. The other protects your own developer account, the one you use to sign in to the Appwrite Console and manage your organizations and projects. This guide is about the second one (Appwrite). If you want MFA for the people who use your app, Appwrite covers that in its Auth documentation instead.

For your Console account, MFA is optional. Appwrite's documentation names a time-based code from an authenticator app (TOTP) as the supported method and says more factors will come later (Appwrite). We use Authenticator App - Novaz on iPhone in the steps below, but any authenticator app works the same way.

How we checked this guide: the Appwrite steps come from Appwrite's own documentation and its screenshots, linked below, which we read on October 21, 2026. We haven't tested them on an Appwrite account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on MFA with an authenticator app

Appwrite's page is short, and its text and screenshots use slightly different labels. These steps follow both (Appwrite):

1. Sign in to the Appwrite Console. Open your account menu at the top right and choose Your account.
2. Go to the security settings. In Appwrite's screenshot, this is Security in the left-hand list, with a Multi-factor authentication card on the page.
3. Turn on the Multi-factor authentication switch.
4. Add the authenticator. The text calls the button Add authentication factor; the screenshot shows an Authenticator app row with an Add button.
5. A Scan QR code window opens. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the Console is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
6. If you can't scan, the same window shows a Manual entry code with a copy button. In Novaz, tap +, then Enter key manually, type a name such as Appwrite in Service, and paste the code into Setup key. See What is a 2FA setup key?
7. Choose Continue and type the current code from Novaz to finish the setup.
8. Save your recovery codes (next section).

The documentation doesn't say how many digits the codes have or how often they change. Scanning the QR code is the safer choice, because it hands those settings to your app. A key typed by hand gives you 6-digit codes every 30 seconds.

The recovery codes are your only way back

Appwrite is unusually blunt about this. Its documentation calls the recovery codes "the only way to access your account if you lose access to your authenticator app" (Appwrite). It doesn't describe a support route for a locked Console account.

Its screenshot shows a Recovery codes row with a View button on the same settings page, so you can look at them again while you're still signed in. Store a copy somewhere other than your phone, such as a password manager or a printout. If you have no Novaz backup, or it's older than your Appwrite account, these codes are your way back. More in 2FA backup codes.

The same screenshot also lists Email as a factor, with one-time codes sent to the account's verified address. The page's text mentions only the authenticator app, so we can't tell you from the documentation whether email codes work as a fallback when you sign in.

If Appwrite rejects your code

Appwrite's documentation doesn't cover rejected codes. The most common cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If you typed the key by hand, check that you copied all of it. Other causes are in Authenticator code not working?

Changing phones

Appwrite doesn't document how to move MFA to a new phone, how to replace the authenticator, or how to turn MFA off. Do any of this while you can still sign in on the old phone, from the same Multi-factor authentication card. If you turned on Novaz's iCloud backup or exported a backup file, you can restore Appwrite on the new phone; without one, you'll add it to the new phone as a new account. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your recovery codes, then set up the authenticator again on your new phone. Without the recovery codes, Appwrite's documentation offers no other route back into the account. More in Lost the phone with your authenticator app?

Official Appwrite help

• Multi-factor authentication (your Console account)
• Multi-factor authentication (Appwrite Auth, for your app's users)
• Security