Buddy 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Buddy is the CI/CD platform at buddy.works where teams build, test and deploy code through pipelines. Before you go looking for the setting, check your plan: Buddy's documentation says two-factor authentication (2FA) is not available on the free plan (Buddy). On a paid plan, each person turns it on for their own account, and a workspace owner or admin can make it mandatory for everyone in the workspace.
Buddy offers two methods: a code by text message (SMS), or an authenticator app. This guide covers the app. We use Authenticator App - Novaz on iPhone, but any authenticator app follows the same steps.
How we checked this guide: the Buddy steps come from Buddy's own documentation and blog, including the screenshots in its docs, linked below, which we read on October 21, 2026. We haven't tested them on a Buddy account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
The setting lives in your personal account settings, which Buddy calls My ID, not in Workspace Settings (Buddy):
- Open My ID and go to the Security tab.
- In the Two-Factor Authentication section, click the + button. Choose Enable authentication app (the other option, Enable text message, is SMS).
- A page called Set up 2FA via a third-party authenticator opens with a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're looking at Buddy on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Next to the QR code there's a Show code button. Buddy's docs don't explain it. If it gives you a text key, you can tap +, then Enter key manually in Novaz and paste it into Setup key. Buddy doesn't say how long its codes last, so scanning the QR code is the safer choice. See What is a 2FA setup key?
- Type the 6-digit code from Novaz into Auth code and click Enable 2FA.
- Buddy then shows your recovery codes (next section).
When it's done, the Two-Factor Authentication section lists Authenticator App as your method.
Download the recovery codes
Buddy creates recovery codes during setup, and the screen won't let you go on until you've downloaded them. The screenshot in Buddy's docs shows ten six-digit codes with a Download button and a copy button (Buddy). Buddy suggests keeping them in a password manager.
If you haven't made a Novaz backup with iCloud backup or a backup file, its keys exist only on your iPhone, so these codes are what gets you in if that phone is gone. Keep them somewhere away from the phone. More in 2FA backup codes.
To see them again later, click + in the Two-Factor Authentication section and choose Show backup codes. The menu item and the screen title use different words, but they mean the same codes. Buddy's 2018 announcement said you could also regenerate them at any time from My ID (Buddy); the current docs don't mention regenerating.
If your workspace enforces 2FA
Workspace owners and admins can switch on Enforce 2FA under Workspace Settings > Security. After that, members who haven't turned on 2FA can't sign in to the workspace (Buddy). If you're blocked, set up 2FA in My ID as above.
With single sign-on (SSO), members with 2FA on sign in at their identity provider and still confirm with their Buddy 2FA method (Buddy).
Git over HTTPS needs a token
If you host repositories on Buddy itself, turning on 2FA changes how Git signs in. Since January 14, 2022, Buddy no longer accepts your username and password for Git over HTTPS once 2FA is on. Use a personal access token or an SSH key instead (Buddy). Both are set up on the same Security tab in My ID.
If Buddy rejects your code
Buddy's docs give no advice for rejected codes. Most of the time the iPhone's clock is off: go to Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?
New phone or lost phone
Buddy's docs don't describe moving 2FA to a new phone or switching from the app to SMS. The screenshot of an enabled account shows a menu (three dots) next to Authenticator App, but the page doesn't say what it offers. In Novaz, you can restore your accounts on the new iPhone from iCloud backup or a backup file. Either way, keep the old phone until Buddy's 2FA works on the new one. See How to transfer your authenticator app to a new iPhone.
If the phone is lost, sign in with one of your recovery codes. Buddy warns that without those codes you won't get back into the account if your device is lost or damaged (Buddy). Its docs don't describe any other recovery process, proof of identity or timeline. The support address Buddy gives is support@buddy.works (Buddy). More in Lost the phone with your authenticator app?
Turning 2FA off isn't documented either.
