Assembla 2FA: how to set up an authenticator app

Assembla hosts Perforce, Subversion and Git repositories along with project management tools (Assembla), so your Assembla login often guards source code. It supports two-factor authentication (2FA) with an authenticator app, and a portfolio owner can make it mandatory for everyone in the portfolio. Two things set it apart. The setup screen gives you a QR code and nothing else, with no key to type. And once 2FA is on, your password stops working in repository clients (Assembla).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app that makes time-based codes works the same way.

How we checked this guide: the Assembla steps come from Assembla's own help center, including the screenshot in its 2FA article, linked below, which we read on October 21, 2026. We haven't tested them on an Assembla account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

• Signed in with SSO? Assembla says an account that uses single sign-on has no password, and without one you can't turn on Assembla's own 2FA (Assembla).
• Google 2FA in your portfolio: the same article notes that if a portfolio requires Google 2FA, that method takes priority. It doesn't explain more than that.
• The app list is old. Assembla's list still includes Windows Phone, but its codes are standard time-based codes, so Novaz can scan the same QR code.

Turn on 2FA with an authenticator app

Assembla's help describes these steps (Assembla):

1. Click your avatar at the top of the page.
2. Choose My Profile > Two-factor authentication. The page says two-factor authentication is currently disabled and shows a QR code.
3. In Novaz, tap +, then Scan QR code, and point the camera at the code on your computer screen. If Assembla is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. Under Confirm current password, type your Assembla password.
5. Under Enter the six-digit code from the application, type the current code from Novaz.
6. Click Enable.
7. Save the recovery code file Assembla gives you. It's your way back in if the phone is lost.

No setup key on the page

Assembla's screen doesn't show a text key. Its help suggests a workaround if your phone can't scan: decode the QR code with a separate reader app, such as a desktop QR reader, to get an otpauth:// link. The secret= part of that link is the key. In Novaz you'd type it under + > Enter key manually as the Setup key. See What is a 2FA setup key?

Scanning is simpler with Novaz. A typed key needs at least 16 characters, and Assembla doesn't say how long its key is.

Your recovery code file

Assembla gives you a file of recovery codes when you turn on 2FA. If the phone goes missing and you have no Novaz backup, or added Assembla after your last backup file, this file is how you get back in. Keep it somewhere you can reach without that phone. Assembla's help doesn't say how many codes the file holds or how to get a new set. More in 2FA backup codes.

Git, SVN and Perforce clients

With 2FA on, external clients can't check out code or commit with your username and password. Create an API key instead (Assembla, Assembla):

1. Click your avatar, then My Profile > API Applications & Sessions.
2. Tick Repository access and click Create.
3. In your client, sign in with your Assembla username and the API secret in place of the password.

When it's required

If a portfolio admin turns the requirement on (More > Portfolio Admin, then Enabled in the Two-factor Authentication section and Update 2FA Settings), members without 2FA must set it up at their next sign-in. Until they do, they can't get into Assembla at all (Assembla).

If Assembla rejects your code

Assembla's help has no advice on rejected codes. The most common cause is a phone clock that has drifted. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

New phone, lost phone, or turning it off

Assembla handles all three the same way: turn 2FA off, then on again with the new device (Assembla).

1. Click your avatar, then My Profile > Two-factor Authentication.
2. Type your password in Confirm current password.
3. In Enter the six-digit code from the application, type a code. If you've lost the phone, Assembla says an unused recovery code goes in this field.
4. Click Disable. You can then set up 2FA again.

If you're changing phones without a Novaz backup, do this while the old iPhone still works. With iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you've lost both the phone and the recovery file, Assembla asks you to email support@assembla.com to reset your account. Its help doesn't say what proof support asks for or how long it takes. See also Lost the phone with your authenticator app?

Official Assembla help

• Using Two-Factor Authentication with your Assembla Account
• Working on my Repos with Third Party Authentication
• Assembla: Managed Cloud Hosting For Perforce, SVN & Git