Bonusly 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Bonusly is the employee recognition platform where coworkers send each other points. Its multi-factor authentication (MFA) works in an unusual way: when you choose to set it up, Bonusly doesn't show the QR code right away. It emails you a link, and the QR code appears only after you follow that link and confirm your password (Bonusly).
The only second step Bonusly offers is a 6-digit code from an authenticator app. There's no text-message option, because Bonusly considers SMS verification out of date (Bonusly). Whether you need it depends on your employer: MFA is optional unless your company has made it required for everyone. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Bonusly steps come from Bonusly's own help center, linked below, which we read on October 21, 2026. We haven't tested them on a Bonusly account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
When your company requires it
A Bonusly admin can turn on Require multi-factor authentication for the whole company and pick a start date. After that date, anyone who hasn't set up MFA is locked out, and nobody can opt out individually. Bonusly doesn't send reminders before the deadline: your company has to announce it (Bonusly).
Bonusly says its own MFA isn't necessary for companies that restrict sign-in to single sign-on (SSO).
Turn on MFA with an authenticator app
You can set it up from your settings at any time (Bonusly, Bonusly):
- Sign in to Bonusly, click your user avatar and open your profile settings.
- Click Security.
- Under Multi-factor authentication, click Set up MFA. (Bonusly's main setup article also mentions an Enable button before this step. Its newer settings article goes straight to Set up MFA, so the labels may differ.)
- Bonusly confirms it has emailed you a link. If it doesn't arrive, use Resend link.
- Open the email, follow the link and enter your Bonusly password.
- A QR code appears. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Enter the 6-digit code Novaz shows and click verify.
If your company already requires MFA and you haven't set it up, the same flow starts at sign-in: after your email and password, you click Set up MFA and Bonusly sends the enrollment email (Bonusly).
Bonusly's help doesn't mention a text key to type instead of scanning, so plan on scanning the QR code. Its codes have 6 digits and change every 30 seconds.
No backup codes
None of Bonusly's MFA articles mention backup or recovery codes. If you lose that iPhone and have no Novaz backup (iCloud backup or a backup file), the way back in is an admin reset (below). It's worth knowing who your company's Bonusly global admins are.
Signing in afterwards
Once MFA is on, Bonusly asks for a code from your authenticator app every time you sign in, after your email and password (Bonusly). Its help doesn't describe a way to remember a trusted device.
If Bonusly rejects your code
Bonusly's help doesn't cover rejected codes. Use the newest code, then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
Bonusly won't let you start a new setup while MFA is still on, so moving to a new phone means clearing the old setup first. Bonusly describes two ways (Bonusly):
- Your company doesn't require MFA: go to Security, click Disable MFA, then Set up MFA again and scan the new QR code with the new phone.
- Your company requires MFA: Disable MFA isn't available, so ask a global admin to reset your MFA. You set it up again the next time you sign in.
With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and skip clearing the setup. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Ask one of your company's global admins to reset your MFA, and give them your work email. They do it under Account settings > Security with Reset user MFA, and they confirm it with a code from their own authenticator app. The reset takes effect at once: you're signed out everywhere, you get an email saying it happened, and you set up MFA again at your next sign-in. Your points and history aren't affected (Bonusly).
Admins can't reset their own MFA this way. If you're the only global admin and you're locked out, email Bonusly Support at support@bonus.ly. Bonusly says most such requests are handled within its support hours, 9am to 9pm Eastern Time. It doesn't say what proof Support asks for. More in Lost the phone with your authenticator app?
Turning MFA off
On the Security page of your profile settings, click Disable MFA, then confirm with Disable MFA. The button isn't available when your company requires MFA (Bonusly). Afterwards, open Bonusly in Novaz and tap Remove account.
