Bitrise 2FA: how to set up an authenticator app

Bitrise is a mobile CI/CD platform: your personal Bitrise account gets you into the workspaces and projects where your iOS and Android builds run. Two-factor authentication (2FA) is optional and uses an authenticator app. Before you turn it on, know one thing about Bitrise: if you lose both your authenticator and your recovery codes, Bitrise says its support team generally can't take 2FA off for you (Bitrise). So this guide spends as much time on the backup plan as on the setup.

Bitrise's docs name Google Authenticator, but the setup is a standard QR code, so any authenticator app works. We use Authenticator App - Novaz on iPhone in the steps below.

How we checked this guide: the Bitrise steps come from Bitrise's own documentation, including its screenshots, linked below, which we read on October 21, 2026. We haven't tested them on a Bitrise account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

The setting lives on your personal account, not on a workspace (Bitrise):

1. Log in to Bitrise and choose Bitrise CI in the left navigation menu.
2. Click your profile image in the upper right corner, then choose Account settings.
3. Choose Security on the left.
4. Under Two-factor authentication, click the 2FA is enabled switch. (Bitrise's docs use that label for both turning it on and turning it off.)
5. A QR code appears. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
6. Type the 6-digit code from Novaz into Bitrise.
7. Save the recovery codes Bitrise gives you.

When 2FA is on and your recovery codes are saved, Bitrise sends a confirmation email from letsconnect@bitrise.io.

Bitrise's page doesn't mention a text key you could type instead of scanning. If you do find one on the setup screen, in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?

Your recovery codes are the real backup

Without a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, and either way the recovery codes are your only fallback inside Bitrise. Store them in a password manager or print them, and keep them away from the phone.

Bitrise's screenshot of the Security page shows a Recovery codes section with a New recovery codes button, which is where you'd get a fresh set. The page text doesn't explain how many codes you get or what happens to the old ones. More on storing them in 2FA backup codes.

When Bitrise asks for a code

Bitrise describes 2FA as an extra step in the login flow (Bitrise). Its docs don't say whether you can mark a browser as trusted, or how often you'll be asked.

If your workspace enforces SAML SSO, you log in through your company's identity provider, and that provider can apply its own 2FA rules (Bitrise). In that case your employer's setup decides how you prove it's you.

If Bitrise rejects your code

Bitrise's docs don't cover rejected codes. The most common cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also note that repeated failed logins can lock your Bitrise account, after which Bitrise emails unlock instructions (Bitrise). Other causes are in Authenticator code not working?

Changing phones

Bitrise doesn't describe a way to move 2FA to a new phone. With a Novaz iCloud backup or backup file, you can simply restore your accounts on the new iPhone. Without one, note that Bitrise's docs say turning 2FA off only asks for your Bitrise password while you're logged in, so while you still have the old phone you can switch 2FA off, then on again, and scan the new QR code on the new iPhone. Save the new recovery codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Start with a recovery code. Without one, your options are narrow (Bitrise):

• A connected Git account. If you linked GitHub, GitLab or Bitbucket to Bitrise earlier, Bitrise suggests trying to log in through it. You can connect these from your account (Bitrise), which is worth doing before you need it.
• Bitrise Support, in rare cases. Bitrise can only remove 2FA if a Git provider account is already connected. Email Support from the address you signed up with and explain why. Support will ask you to create a new public repository named bitrise_verification on that Git account and send them its link. They may still refuse if removing 2FA looks like a security risk.
• A new account. With no connected Git account, Bitrise recommends creating a new Bitrise account.

Bitrise doesn't say how long a support request takes. More in Lost the phone with your authenticator app?

Turning 2FA off

Go to Account settings > Security, click 2FA is enabled under Two-factor authentication, and enter your Bitrise password in the Edit profile window, then click Done (Bitrise). Then open the Bitrise entry in Novaz and tap Remove account.

Official Bitrise help

• Two-factor authentication
• Accounts overview
• Configuring SAML SSO on Bitrise
• Resetting your password