Basecamp 2FA: how to set up an authenticator app

Basecamp is the project management app from 37signals. One Basecamp login can belong to several accounts at once, such as your company's and a client's, and two-factor authentication (2FA) protects that login. It's built around an authenticator app that gives you a 6-digit code after your password, with recovery codes for emergencies and security keys as an optional extra (Basecamp). Basecamp's help doesn't mention text-message codes.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Basecamp steps come from Basecamp's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a Basecamp account, and the help doesn't walk through the setup screens themselves, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is it required?

Only if your account owner says so. Owners can require 2FA for everyone, and anyone without it is then asked to set it up at their next login. Clients are exempt (Basecamp).

Requiring 2FA is an Admin Pro Pack feature, which comes only with the Pro Unlimited plan (Basecamp).

Turn on 2FA with an authenticator app

1. In Basecamp, click your profile picture in the bottom left.
2. Go to Account & Settings, then Profile, password, 2FA.
3. Click Change your login info. Basecamp's help links this login info page to launchpad.37signals.com, the 37signals sign-in site.
4. Click Set up 2FA and follow the steps on screen (Basecamp).
5. When a QR code appears, open Novaz, tap +, then Scan QR code, and point the camera at it. Working on the iPhone itself? Screenshot the code, then use Choose a photo. See scanning a QR code on the same iPhone.
6. If Basecamp asks for a code to confirm, type the 6-digit code Novaz shows for Basecamp.
7. Save the recovery codes Basecamp gives you at the end.

Basecamp's help doesn't say whether setup also offers a text key, or how often its codes change. Scanning is safer, because the QR code passes those settings to your app. If you can only get a text key, tap +, then Enter key manually in Novaz, and paste it as the Setup key. See What is a 2FA setup key?

Your recovery codes are the backup

Basecamp's help says you'll need the recovery codes if you ever lose access to your authenticator app. If the phone is gone and you have no Novaz backup, these codes are your way back in. Store them in a password manager or on paper, away from the iPhone.

While you're signed in, you can view them again from Change your login info (Basecamp). More in 2FA backup codes.

Adding a security key

Once 2FA is on, you can also add a hardware key, a fingerprint reader or Windows Hello under Security keys > Add a security key on the same page. Basecamp says keys resist phishing better than codes, and Novaz or a recovery code still works when the key isn't at hand (Basecamp).

When Basecamp asks for a code

Basecamp asks for the code right after your password when you log in. Its help doesn't say whether it remembers trusted devices or how the mobile apps handle the step. It also doesn't say whether the code applies when you use Sign in with Google instead of a password (Basecamp).

If Basecamp rejects your code

Basecamp's help has no advice for rejected codes. A clock that's drifted is the usual culprit, so check Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Changing phones

The login info page is also where you reconfigure 2FA (Basecamp). Do it while the old phone still gives you codes, then scan the new QR code on the new iPhone. Or, if you use Novaz's iCloud backup or a backup file, just restore your accounts on the new iPhone; the codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Basecamp's help describes these routes (Basecamp):

1. A recovery code. Use one at the code prompt.
2. A device that's still signed in. Open Change your login info there to view your recovery codes or set up 2FA again.
3. An admin or owner on your account. From Manage people in Adminland, they can open the ••• menu next to your name and choose Turn off 2FA (Basecamp).
4. Basecamp support. If your login belongs to more than one Basecamp account, or you don't know who your admins are, write to support@basecamp.com from the email address on your account. Admins and owners can't turn off 2FA for someone on several accounts.

Basecamp doesn't say what other proof it asks for or how long a reset takes. More in Lost the phone with your authenticator app?

Turning 2FA off

Basecamp's help doesn't describe a way to turn 2FA off yourself, only the admin and support routes above. If your owner requires 2FA, you'll be asked to set it up again at your next login.

Official Basecamp help

• Password & Two-Factor Authentication
• Managing people
• Owner and Admin Actions
• Admin Pro Pack features
• Logging In and Out