Brex 2FA: how to set up an authenticator app

Brex is the corporate card, expense and business banking platform many companies hand to their employees, so your Brex sign-in is often a work account that an admin at your company manages. Two-factor authentication (2FA) isn't optional there: Brex requires it for every user, and once it's on it can't be turned off (Brex). What you do choose is the method. Brex offers text messages or an authenticator app, and it recommends the app. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Brex steps come from Brex's own help center articles, linked below, which we read on October 21, 2026. We haven't tested them on a Brex account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

• Allow pop-ups for the Brex dashboard. Brex may open a pop-up window to confirm it's you during setup, and its help warns that setup can fail if pop-ups are blocked (Brex).
• Set your phone's clock to automatic. Brex makes this a step of its own. On iPhone: Settings > General > Date & Time > Set Automatically.
• Signing in with SSO? If your company signs you in to Brex through single sign-on, Brex says you won't be asked for a 2FA code at sign-in.

Switch to an authenticator app

Because 2FA is already required, the setting is called Change method rather than an on switch. Brex's steps (Brex):

1. In the Brex dashboard, click your company name at the top left and go to Personal settings > Security and privacy.
2. Under Personal, find Two-factor authentication and click Change method.
3. Choose Authenticator app and click Continue.
4. Brex shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're looking at the dashboard on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone. Then click Continue in Brex.
5. If the QR code won't scan, Brex shows a code on screen for manual entry. In Novaz, tap +, then Enter key manually, fill in Service (for example, Brex) and paste or type that code as the Setup key. See What is a 2FA setup key?
6. Type the six-digit code from Novaz and click Continue. Brex says the code usually lasts 30 seconds, which matches what Novaz uses for a typed key.
7. Copy or download your recovery codes, store them somewhere safe, and click Continue.

Brex's SMS instructions start from Settings instead of Personal settings, so the menu name may look slightly different in your dashboard.

Your recovery codes are the backup

Each Brex recovery code works once, and you use one to sign in if you lose your phone (Brex). Unless you've backed up Novaz with iCloud backup or a backup file, its keys exist only on your iPhone, so these codes are what stands between a lost phone and a call to your admin. Keep them in a password manager or on paper, away from the phone. More in 2FA backup codes.

When Brex asks for a code

You enter a code from your app after your password each time you sign in with 2FA. Separately, Brex runs device verification: the first time you sign in on a browser or device, it emails you a "New sign-in to Brex" message, and you approve with Trust this device (about a year) or Allow once (Brex). That email step isn't your authenticator code, so don't look for it in Novaz.

Brex also says it will never call you to ask for a 2FA code, and that you should only type one on its own sign-in pages, dashboard.brex.com and accounts.brex.com (Brex).

If Brex rejects your code

Brex's sign-in help gives three checks for authenticator codes (Brex):

• Make sure the phone's date and time are set to automatic. Novaz also warns you when the clock is 15 seconds or more off.
• Make sure you're reading the Brex entry in your app, not a code for another account.
• If it still fails, click Enter recovery code on the sign-in screen and use one of your saved codes.

Other causes are in Authenticator code not working?

If you lose your authenticator

Brex gives you a few routes back in (Brex, Brex):

1. A recovery code. Click Enter recovery code when Brex asks for your 2FA code.
2. The reset link. On the sign-in screen, click Reset your two-factor authentication (2FA). Brex says this option isn't there if your method is SMS.
3. Your Brex admin. An admin can email you a one-time recovery code: in the dashboard they open Teams, select you, then User actions > Send 2FA recovery code > Send code. The email goes to the address Brex has on file for you, and the code is valid for 2 hours. After you sign in with it, set up 2FA again with the steps above.
4. Brex Support. If none of that works, Brex says to start a chat with its support team and ask for a reset code.

Brex's help doesn't say what proof support asks for or how long a reset takes. See also Lost the phone with your authenticator app?

Changing phones

Brex's help doesn't describe moving 2FA to a new phone. Change method is where setup starts, so the practical approach is to keep the old phone until the new one is set up and working. If you use Novaz's iCloud backup or a backup file, restore it on the new iPhone and your Brex codes carry on working. Without one, you'll add Brex again on the new phone. See How to transfer your authenticator app to a new iPhone.

Official Brex help

• Two-factor authentication (2FA)
• Sign in help
• Protecting your Brex account