BitGo 2FA: how to set up an authenticator app

BitGo is a platform for storing digital assets and approving transactions, used mostly by organizations and their teams through the web app at app.bitgo.com. Two-factor authentication (2FA) isn't an optional extra here: BitGo asks you to set it up while you create your account, with either an authenticator app or a hardware key such as a YubiKey (BitGo). BitGo now recommends passkeys as the strongest sign-in, but an authenticator app is still a supported method, and you need its code to add a passkey in the first place (BitGo).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app that makes time-based codes works the same way.

How we checked this guide: the BitGo steps come from BitGo's own Resource Center articles, linked below, which we read on October 21, 2026. We haven't tested them on a BitGo account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

What BitGo supports

BitGo's pages list these sign-in and approval methods (BitGo, BitGo):

• Time Window: BitGo's name for codes from an authenticator app (time-based one-time passwords). This is the one Novaz handles.
• Security Key: a hardware key such as a YubiKey.
• Web Authentication (WebAuthn) and passkeys, stored in a password manager or on a FIDO2 security key.

If your company's IT or security team has an approved authenticator app, BitGo suggests you use that one.

Add an authenticator app

Set this up on the BitGo website, not in the BitGo Verify mobile app. BitGo says all methods start on app.bitgo.com, and the app then uses them (BitGo).

1. Sign in at app.bitgo.com.
2. Select your profile icon in the top right corner and open your settings.
3. Go to 2-Factor Authentication and select Add a 2FA Method.
4. Choose Time Window as the method.
5. BitGo shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on your iPhone's own screen, take a screenshot, tap + and use Choose a photo instead. See scanning a QR code on the same iPhone.
6. Type the 6-digit code from Novaz into BitGo to confirm.
7. Check that the new method is listed in the 2-Factor Authentication section.

BitGo's articles don't use the same menu names. The newest one, from September 2026, says Account Settings > 2-Factor Authentication (BitGo). Others say Personal Settings > Authentication, or Settings > Security (BitGo, BitGo). Look for whichever your account shows.

None of the articles mentions a text key you could type instead of scanning, so plan on scanning the QR code. If BitGo does show one, Novaz's Enter key manually works too. See What is a 2FA setup key?

Save the recovery codes

When you set up 2FA during sign-up, BitGo gives you one-time recovery codes and saves them to your device as a text file. BitGo's advice is to write them down, keep them somewhere secure, and then delete the file (BitGo). You get 10 codes of 12 characters each, every code works once, and you can download them again from your settings page (BitGo).

Take this step seriously if you use Novaz. Without an iCloud backup or a backup file, its keys exist only on your iPhone, so the recovery codes are what stands between a lost phone and an identity check. More in 2FA backup codes.

When BitGo asks for a code

Your 2FA code is needed for more than signing in. BitGo also asks for it when you sign transactions and approve pending requests (BitGo). When you send funds, for example, you enter the 2FA code and then your wallet password (BitGo). Adding a passkey also asks for a code from your authenticator app.

If BitGo rejects your code

BitGo's articles don't cover rejected codes. The usual cause is the phone's clock. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

BitGo lists a phone change as one reason to use its 2FA reset, described below. If your old phone still works, there's an easier route: the same settings section where you add a method also lets you remove one (BitGo). Add Novaz on the new iPhone as a Time Window method while you can still sign in, then remove the old one. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and skip this. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

BitGo has a self-serve reset (BitGo):

1. On the login page, enter your email and password, then select Reset 2FA on the Two-Factor Authentication screen.
2. If a new IP address was verified on your account in the last 24 hours, you wait 24 hours first.
3. You verify your identity with Persona: a government-issued ID and a selfie check.
4. BitGo then checks the balance of the hot wallets and trading accounts where you can spend. With $0, you set up new 2FA right away. With $1 to $9,999, you also need a recovery code or details from your BitGo KeyCard. At $10,000 or more, you contact BitGo Support for a video ID verification.

Your old 2FA keeps working until the reset is finished, and a reset request expires after 24 hours. If you can't finish the flow, BitGo's address is support@bitgo.com. More in Lost the phone with your authenticator app?

If you think your 2FA was compromised rather than lost, BitGo's incident page says to remove that device under 2-Factor Authentication in your settings and set up a new one (BitGo). BitGo's pages don't describe turning 2FA off completely.

Official BitGo help

• Set Up Two-Factor Authentication and Save Recovery Codes
• Passkeys and 2FA: Supported Authentication Methods
• Add 2FA or a Passkey to Your BitGo Account
• Access and Manage Your Profile Settings
• Set Up the BitGo Verify Mobile App
• How to reset Two Factor Authentication
• How to Transfer or Withdraw Assets from Your Wallet
• Security Incident Response