Buffer 2FA: how to set up an authenticator app

Your Buffer account schedules and publishes posts to your social channels, so anyone who gets in can post as you. Two-factor authentication (2FA) is optional, unless your team's owner or admin requires it. The second code can come from an authenticator app or by email (Buffer). Buffer doesn't offer text messages (Buffer). Unusually, you get one recovery code at a time, not a list. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Buffer steps come from Buffer's own help center, linked below, which we read on October 19, 2026. We haven't tested them on a Buffer account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Buffer's help describes these steps in the web app (Buffer):

1. Click your profile avatar in the lower-left corner of the dashboard, then Settings.
2. Switch the Two Factor Authentication toggle to Enabled. It turns blue.
3. Choose Authenticator App. (Email sends the codes to your inbox instead.)
4. Buffer shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If Buffer is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Click Next in Buffer, type the 6-digit code from Novaz, and click Next again.
6. Copy your recovery code and keep it somewhere safe, then click Done.

Buffer's help only mentions the QR code, not a key to type. If Buffer does show a key, tap + in Novaz, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?

One recovery code, renewed after each use

Buffer's help talks about a single recovery code that works once. When you sign in with it, Buffer makes a new one right away. Copy it from Settings under Two-factor authentication in place of the old one (Buffer).

Buffer also emails you whenever the recovery code is used, with the sign-in's date, rough location, IP address and browser. If it wasn't you, Buffer says to change your password (Buffer).

If you lose your iPhone and have no Novaz backup (iCloud backup or a backup file), this code is your way back in. Store it in a password manager or on paper. See 2FA backup codes.

When Buffer asks for a code

With 2FA on, Buffer asks for a code every time you log in, after your email and password (Buffer). Those prompts replace the Confirm your recent login attempt emails that Buffer sends without 2FA when a sign-in looks new (Buffer).

Requiring 2FA for a team

Team owners and admins can make 2FA mandatory. For now, Buffer says this works only in the web app, on Team and Essentials plans, with Beta features turned on (Buffer):

1. Click your profile avatar in the lower-left corner and choose Manage Team.
2. At the bottom of the page, turn on Require two-factor authentication.

Members who use 2FA get a ✓ 2FA badge. Anyone without it must set it up at their next login, choosing Authenticator App or Email, then Continue.

If Buffer rejects your code

Buffer's help doesn't cover rejected authenticator codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

Don't keep retrying. Buffer locks an account for an hour after 10 failed login attempts. It doesn't say whether wrong 2FA codes count toward that (Buffer). More causes are in Authenticator code not working?

Changing phones

Buffer's help doesn't describe moving 2FA to a new phone. While you can still sign in, you can turn 2FA off in Settings and on again, scanning the new QR code with the new phone. If Novaz is backed up with iCloud backup or a backup file, you can restore your accounts on the new iPhone and skip that. Otherwise, you'll set Buffer up again. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

• You have the recovery code: sign in with it, then save the new code Buffer makes. To link a new phone, turn 2FA off and on again.
• You don't: email hello@buffer.com from the address you sign in with. Buffer says it will run "a few security checks" to get you back in (Buffer). It doesn't list the checks or say how long they take.

Support works through the email address on your account, so keep it working. You can add a backup address in Settings under Backup Email, which Buffer uses only for account recovery (Buffer).

More in Lost the phone with your authenticator app?

Turning 2FA off

In Settings, switch Two Factor Authentication off. Buffer emails you a one-time code. Type it and click Confirm (Buffer). The confirmation comes by email, not from your authenticator app. Then remove the Buffer account from Novaz: open it and tap Remove account.

Official Buffer help

• Using two-factor authentication in Buffer
• I can’t log in to my Buffer account
• Verifying your Buffer email address and logins
• Best practices for Buffer account security