Cal.com 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Cal.com account holds your connected calendars, your booking links and the contact details of everyone who booked a meeting with you. Its two-factor authentication (2FA) has one method, a time-based code from an authenticator app such as Google Authenticator (Cal.com). There's no text-message option. Check how you sign in first: Cal.com's 2FA only applies to accounts that use an email address and password, not to accounts that sign in through Google or another provider (Cal.com source).
It's optional for regular users. If you're in a Cal.com organization, your admins can see in the members table whether you've turned it on (Cal.com). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: Cal.com's help center has no 2FA setup article, so the Cal.com steps come from Cal.com's own blog and help pages, linked below, and the exact screen labels come from the Cal.com source code it published on GitHub (version 6.2.0, March 2026). That repository has since become Cal.diy, a separate community edition, so the hosted Cal.com screens may have changed. We read everything on October 21, 2026. We haven't tested the steps on a Cal.com account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
The setting lives in the Security part of your settings (Cal.com). Labels below are from Cal.com's code (Cal.com source).
- Sign in to Cal.com and open Settings. Under Security, choose Two factor authentication. The direct address is app.cal.com/settings/security/two-factor-auth.
- Switch on the Two factor authentication toggle. It shows Disabled until setup is done.
- In the Enable two-factor authentication window, type your current Password and select Continue.
- Cal.com shows a QR code with a text code under it. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo (how that works).
- To type the text code instead, tap +, then Enter key manually in Novaz. Put Cal.com as the Service, your email as the Account, and the text code as the Setup key. Cal.com's key is 32 characters and uses the standard 6-digit, 30-second codes, so typing it works as well as scanning (Cal.com source). More in What is a 2FA setup key?
- Select Continue, type the six-digit code from Novaz, and select Enable.
- The window switches to Backup codes. Select Download or Copy to save them, then Close.
The account shows up in your app under the name "Cal".
Save the backup codes before you close the window
Cal.com makes ten backup codes, in the form XXXXX-XXXXX, and each one works once in place of an app code (Cal.com source). Download saves them as a text file named cal-backup-codes.txt.
We found no other place that shows them. To get a fresh set, turn 2FA off and set it up again, which creates a new key and new codes. If that phone is gone and Novaz has no iCloud backup or backup file to restore, these codes get you back in. Keep them in a password manager or on paper. See 2FA backup codes.
Signing in
After your email and password, Cal.com asks for a Two-factor code (Cal.com source). Cal.com doesn't document an option to remember a device. To use a backup code, select Lost access on that screen and type one; Go back returns you to the app-code field.
Be careful with retries. Cal.com counts every wrong password, wrong 2FA code and wrong backup code, and after 10 failures in a row it can lock the account until an organization admin unlocks it (Cal.com). Cal.com says this lockout isn't switched on everywhere yet.
If Cal.com rejects your code
Cal.com only says the code is incorrect. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Fix the clock before you try again, so you don't hit the lockout. Other causes are in Authenticator code not working?
Moving to a new iPhone
Cal.com has no separate "move" step. While you still have the old phone, switch the toggle off, then on again, and scan the new QR code with the new phone. With a Novaz iCloud backup or backup file, you can restore Cal.com on the new iPhone and skip this. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with a backup code through Lost access, then turn 2FA off and set it up again on your new phone. Do it soon, since each code works only once.
Without backup codes, Cal.com's help center doesn't describe a recovery process. It doesn't say what proof support asks for or how long a reset takes. The help center links to Cal.com support at the top of each page (Cal.com). If you're in an organization, its admins can unlock a locked account, but the help doesn't say they can remove 2FA. More in Lost the phone with your authenticator app?
Turning 2FA off
Switch off the Two factor authentication toggle. The Disable two-factor authentication window asks for your password and an app code, or a backup code through Lost access, then Disable (Cal.com source). Cal.com recommends turning it back on as soon as you can.
