Canva 2FA: how to set up an authenticator app

Your Canva account holds your designs and uploads. Canva calls its two-factor authentication multi-factor authentication (MFA). The method its help pages describe is an authenticator app: once it's on, Canva asks for the 6-digit code from the app each time you log in (Canva).

There's one catch before you start. Canva suggests logging in with Apple, Facebook or Google so you don't need a password (Canva), but MFA with an authenticator app needs one. If you use a social login, you have to set a Canva password first (Canva).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Canva details come from Canva's own help pages and its developer site, canva.dev, linked below, which we read on October 20, 2026. Canva's help center blocks automated access, so we read its pages in archived copies on web.archive.org, saved in January 2026. Canva's main MFA article had no readable copy, so where the setting is comes from a screenshot in Canva's developer blog from June 2024. We haven't tested the steps on a Canva account, so a label may differ. The Novaz steps are checked against the app, version 1.0.5.

Do you need it?

• Developers: yes. Canva's developer docs say your account must have MFA on before you build an app with its Autofill API (Canva). Canva's 2024 launch post says it prompts you to turn MFA on when you create a Connect API integration (Canva).
• Everyone else: it's optional, but Canva lists it among the steps it recommends to protect your account (Canva).

Turn on MFA with an authenticator app

1. If you log in with a social account, set a Canva password first.
2. Open your Canva settings and select Login & security.
3. Under Security, find Multi Factor Authentication (MFA). Next to Authenticator app, select Enable (Canva).
4. Follow the steps on screen. If Canva shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If Canva gives you a text key instead, tap +, then Enter key manually. Type Canva as the Service, add your email as the Account if you like, and paste the key as the Setup key. See What is a 2FA setup key?
6. Enter the 6-digit code from Novaz when Canva asks for it.

We couldn't see the screens after Enable, so we can't say what Canva calls its text key. Scan the QR code if you can: it tells Novaz how Canva's codes are set up, while a typed key always gets 6-digit codes every 30 seconds.

The labels come from a 2024 screenshot, so Canva's settings may look different now. Canva's full steps are in Setting up Multi-Factor Authentication (MFA).

Generate backup codes

Canva offers MFA backup codes. Its audit-log documentation for admins records an event each time someone generates backup codes for their account, and points to a section of the MFA article on generating them (Canva). We couldn't read how many codes you get or where the button is.

Make them as soon as MFA is on and keep them away from your phone. They're your way in if the iPhone is lost and Novaz has no iCloud backup or backup file. See 2FA backup codes.

When Canva asks for a code

Every time you log in (Canva). Canva's settings screen in the 2024 screenshot puts it this way: "After entering your password, you'll be asked for a second verification step" (Canva). The pages we read don't mention a way to skip the code on a trusted device, and don't say whether Canva also asks for it when you log in with Google or another social account.

Canva's audit-log documentation also lists text-message (SMS) MFA and passkeys as separate settings on an account (Canva). The help pages we could read only describe the authenticator app.

If Canva rejects your code

The Canva pages we could read don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. More in Authenticator code not working?

Changing phones

The Canva pages we could read don't describe moving MFA to a new phone. If you use Novaz's iCloud backup or a backup file, restore it on the new iPhone and Canva comes along. Otherwise, Canva has to be added again on the new one. Keep the old iPhone and your backup codes until that's done, and check Canva's MFA article for how to switch apps. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Backup codes are there for this, so use one when Canva asks for a code. Beyond that, the pages we could read don't say how Canva handles a lost authenticator, what proof it asks for, or how long it takes. So make backup codes right after setup, and read Canva's MFA article while you can still log in. More in Lost the phone with your authenticator app?

Official Canva help

• Setting up Multi-Factor Authentication (MFA) (Canva's main article; we couldn't read it)
• Protect your account
• Account settings
• Launching to all: Connect APIs (Canva Developers Blog)
• Autofill designs with data
• Users - Canva Audit Logs Documentation