Skip to content
Novaz AuthenticatorGET

Bybit 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. The one thing to save: your Recovery Key Phrase
  2. Turn on 2FA with an authenticator app
  3. If Bybit rejects your code
  4. Moving to a new iPhone
  5. If you lose your authenticator
  6. Turning it off
  7. Official Bybit help

Your Bybit account holds the crypto you trade on the Bybit exchange. Bybit's settings call the authenticator app Google Two Factor Authentication. Once it's linked, Bybit asks for its codes when you sign in, withdraw, reset your password, change security settings or manage API keys (Bybit). It's recommended, not required, but you can't save withdrawal addresses without it (Bybit). Email and SMS codes, passkeys and a fund password are the other protections (Bybit).

Despite the name, any authenticator app will do: Bybit's troubleshooting page says its advice fits most 2FA apps (Bybit). This guide uses Authenticator App - Novaz on iPhone; other apps work the same way.

How we checked this guide: the Bybit steps come from Bybit's own help center, linked below, which we read on October 20, 2026. Bybit's servers refuse automated requests, so we read each page in a copy saved by the Internet Archive (web.archive.org); the copies date from March to July 2026, and some screenshots in them from 2024. We haven't tested the steps on a Bybit account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

The one thing to save: your Recovery Key Phrase

Bybit has no backup codes. Instead it shows a Recovery Key Phrase, which is really the setup key: the QR code's secret as letters and numbers. You see it once, during setup, and Bybit keeps no copy (Bybit). With it, you can add Bybit to an authenticator app on any phone (Bybit). Without it, a lost phone means a reset.

Even if you back up Novaz with iCloud backup or a backup file, save this phrase: it's the way back in if the phone is lost without a current Novaz backup. Keep it away from the phone, in a password manager or on paper, and guard it like a password: anyone who has it can make your Bybit codes.

Turn on 2FA with an authenticator app

On the Bybit website

The website shows a QR code (Bybit):

  1. Sign in and open your security settings (bybit.com/app/user/security). Under Advanced Protection, click Settings next to Google Two Factor Authentication.
  2. Click Send Verification Code, type the code Bybit sends to your email address or phone, and click Confirm.
  3. A window titled Set Up Google Two-Factor Authentication opens with a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. On the same iPhone, take a screenshot and use Choose a photo (how).
  4. Save the key phrase shown as text below the QR code.
  5. Type the 6-digit code from Novaz in Google 2FA Code and click Confirm.

In the Bybit app

The app gives you a key to copy instead (Bybit):

  1. Tap Home, then the profile icon at the top left, then Security.
  2. Turn on the switch next to Google Authentication and enter the code sent by email or SMS.
  3. Tap Continue. Write down the Recovery Key Phrase, then tap Copy key.
  4. In Novaz, tap +, then Enter key manually. Enter Bybit as the Service and paste the key into Setup key. See What is a 2FA setup key?
  5. Back in Bybit, tap Next, type the 6-digit code from Novaz and tap Confirm.

A typed key must be at least 16 characters, and Novaz gives it 6-digit codes every 30 seconds. Bybit confirms 6 digits but doesn't state the interval or key length, so if Novaz refuses the key or Bybit refuses its codes, use the website's QR code.

If Bybit rejects your code

Bybit's troubleshooting article lists these causes (Bybit):

  • Wrong entry. Use the Bybit entry labeled with your Bybit email or phone number.
  • Clock drift. A few seconds off can be enough. Turn on Settings > General > Date & Time > Set Automatically. Novaz warns when the clock is 15 seconds or more off.
  • Cache. Try a private browser window, or in the Bybit app use Settings > Clear Cache.
  • Connection. Turn off any VPN, and don't send a code that's about to expire.

As a last resort, Bybit suggests re-adding the account with your Recovery Key Phrase. More in Authenticator code not working?

Moving to a new iPhone

Apart from Google Authenticator's export tool, which doesn't apply here, Bybit's way is to type the Recovery Key Phrase into the app on the new phone (Bybit). If you back up Novaz with iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. Otherwise, do that: tap +, then Enter key manually, and use the phrase as the Setup key. Once the codes match, open Bybit on the old phone and tap Remove account. See How to transfer your authenticator app to a new iPhone.

Bybit warns against Google Authenticator's cloud sync, which isn't end-to-end encrypted (Bybit). Novaz doesn't sync its codes unless you turn on iCloud backup, which is end-to-end encrypted through iCloud Keychain.

If you lose your authenticator

With the Recovery Key Phrase, just add Bybit to Novaz again. Without it, Bybit can unbind the authenticator (Bybit, Bybit):

  1. Sign in with your email address or phone number and password.
  2. When the security check appears, click Having problems with verification.
  3. Choose Google Authenticator isn't working. I'd like to reset it. (older pages word it differently).
  4. Enter the codes Bybit sends to your email, your phone, or both.
  5. Pass any extra check, such as another code or facial verification.

The authenticator is then removed at once, or support reviews the request within 1-3 working days. Suspended or restricted accounts can't use this route. If you've also lost the email or phone number, file a case through Bybit's support form; support contacts you within 1-3 working days.

Disabling or resetting the authenticator blocks withdrawals, transfers and P2P trades for 24 hours (Bybit). Then set it up again and save the new phrase. See Lost the phone with your authenticator app?

Turning it off

Bybit wants the authenticator linked at all times (Bybit). Its help describes no off switch in settings; the reset above is the only documented way to remove it.

Official Bybit help

Read in web.archive.org copies saved between March and July 2026.

More guides: Crypto exchanges and wallets