Canada Revenue Agency 2FA: how to set up an authenticator app for your CRA account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your CRA account is the Canada Revenue Agency's single sign-in for My Account, My Business Account and Represent a Client, where you manage your tax and benefit information (CRA). Two-factor authentication, which the CRA calls multi-factor authentication (MFA), can't be skipped here: "MFA is mandatory for all CRA account users." (CRA). Your one-time passcode comes from a third-party authenticator app, a passcode grid the CRA generates, or a phone that gets a text or call. This guide uses Authenticator App - Novaz on iPhone. Any other authenticator app works the same way.
How we checked this guide: the CRA steps come from the Canada Revenue Agency's own help pages on canada.ca, linked below, which we read on October 20, 2026. We haven't tested them on a CRA account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Who has to set it up
If you sign in with a CRA user ID and password or a Sign-In Partner (online banking), MFA applies to you, and you manage it in the CRA account (CRA). If you sign in with a BC Services Card, the CRA says you won't have to enroll in MFA (CRA). Of the provincial partner users, only those with an Alberta.ca Account can update MFA options in the CRA's Security settings (CRA).
Add an authenticator app
Registration prompts you for two MFA options, though only one is required for now. Pages name the app option differently (Third-party authentication app, Third-party authenticator app, Authenticator app) (CRA, CRA).
To add it to an existing account (CRA):
- Sign in to your CRA account.
- On your Welcome page, select Security settings.
- Choose Multi-factor authentication, then Continue.
- Choose Authenticator app, where you can add or remove an app.
- The CRA shows a QR code. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Or type the setup key the CRA provides: in Novaz, tap +, then Enter key manually, put CRA in Service and the key in Setup key. See What is a 2FA setup key?
- The help pages don't describe the screens after this. If the CRA asks for a code, use the one Novaz shows.
Passcodes are 6 digits and change every 30 seconds (CRA), which matches what Novaz makes from a typed key. The CRA doesn't say how long its key is, so if Novaz rejects the key, scan the QR code.
No backup codes: enroll a second option
The CRA has no backup or recovery codes. Your fallback is another MFA option, and the CRA recommends more than one in case you delete the app or change numbers (CRA). Novaz's keys live only on your iPhone unless you turn on iCloud backup or export a backup file, so add a second option either way.
The passcode grid needs no phone. It's a table of numbered rows and lettered columns, and at each sign-in the CRA asks for three cells, such as B,1. A grid lasts 18 months; make a new one under Security settings > Multi-factor authentication. An expired grid still signs you in once, and you get a new one then (CRA). Print it and keep it away from your phone. The phone option only takes numbers you can dial from Canada as 1 plus 10 digits (CRA).
When the CRA asks for a code
At every sign-in (CRA). The pages don't mention remembering a device. If you phone the CRA, you may give a current passcode to confirm your identity. Otherwise keep it private: the CRA never calls to ask for it (CRA).
If the CRA rejects your code
Don't keep guessing. Too many wrong passcodes lock you out for 30 minutes. The third lockout is permanent, and only a call to the CRA fixes it (CRA).
Before retrying, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. If a code is about to change, wait for the next one. See Authenticator code not working?
Changing phones
The CRA doesn't describe a phone switch, but its settings let you remove and add an authenticator app (CRA). With the old iPhone still working and your grid or phone enrolled, remove the app in Security settings, then add it again with Novaz on the new iPhone. Or skip that and restore Novaz on the new iPhone from iCloud backup or a backup file. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- Use another option: your passcode grid or enrolled phone. If texts don't arrive, try Call me instead of Text me (CRA).
- Registering again won't help. That route back in requires an existing MFA option (CRA).
- Call the CRA, which can unlock your account (CRA): 1-800-959-8281, option 1 for online services, Monday to Friday, 8 am to 8 pm ET. From Yukon, the Northwest Territories or Nunavut, call 1-866-426-1527; from outside Canada and the U.S., call 1-613-940-8495 collect (CRA).
Have your social insurance number, name, date of birth, address and a tax document such as a notice of assessment ready. The CRA doesn't say how long it takes. More in Lost the phone with your authenticator app?
Removing the authenticator app
MFA can't be turned off. You can remove the authenticator app under Security settings > Multi-factor authentication (CRA), but the pages don't say whether you can remove your only option. Afterwards, open CRA in Novaz and tap Remove account.
