Canvas LMS 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Canvas LMS, made by Instructure, is where many schools and universities run their courses, assignments and grades. Whether it uses multi-factor authentication (MFA) is up to your school. A Canvas administrator picks one of four settings for the whole account: Disabled, Optional, Required for Admins or Required (Instructure). When it's on, Canvas offers two methods: a time-based code from an authenticator app, or a code sent by text message (Instructure). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Canvas steps come from Instructure's official Canvas guides on the Instructure Community site, including their screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a Canvas account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
What your school's setting means for you
- Optional: the setup button is in your user settings, and you can change or turn off MFA later.
- Required: Canvas shows you the MFA setup page right after you log in (Instructure).
- Required for Admins applies only to administrator roles, and Disabled removes the option.
Schools that sign you in through their own identity provider get extra MFA choices in Canvas (Instructure). A two-step check on your school's own sign-in page is a separate system; ask your school's help desk about that one.
Turn on 2FA with an authenticator app
Instructure's guide describes this flow (Instructure):
- In Canvas, in the Global Navigation bar, click Account, then Settings.
- Click Set Up Multi-Factor Authentication. (Where MFA is required, the setup page appears after you log in instead.)
- The Multi-Factor Authentication page shows a QR code under Use Authenticator App. In Novaz, tap +, then Scan QR code, and point the camera at it. If Canvas is open in a browser on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the current code from Novaz in the Verification Code field.
- To skip codes on this computer in the future, check Remember this computer.
- Click Verify.
Instructure's screenshot also shows a Secret Key under the QR code. To use it, tap + in Novaz, then Enter key manually, and enter it as the Setup key (What is a 2FA setup key?). The guide doesn't say how many digits Canvas codes have or how often they change. A typed key always gets 6 digits every 30 seconds, while the QR code carries Canvas's own settings, so scan it if you can.
The text-message option asks for your phone number and your mobile carrier before it sends a code.
Print the backup codes
Canvas's setup page tells you to print backup codes from your profile afterwards. Your Settings page then has a Multi-Factor Authentication Backup Codes button, available to everyone who uses MFA (Instructure). The guide doesn't say how many codes you get.
Do it right away. If that phone is lost and you haven't backed up Novaz with iCloud backup or a backup file, these codes are your way back in. Keep them on paper or in a password manager, away from that phone. More in 2FA backup codes.
When Canvas asks for a code
From now on, logging in takes your Canvas password and a code from Novaz, except on a computer where you checked Remember this computer. Instructure doesn't say how long a computer stays remembered.
If Canvas rejects your code
Instructure's guides don't cover rejected codes. Start with your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
Then check which Canvas site you're on. Some schools have beta and test copies of Canvas, but MFA is set up only on the live (production) site. When you set up or reset MFA there, the beta and test sites keep your old setup until their next refresh, and text-message codes are never sent on those sites (Instructure). So a correct code can still fail on a test site. Other causes are in Authenticator code not working?
Changing phones
If MFA is optional at your school, Settings also shows Reconfigure Multi-Factor Authentication, which lets you set it up again with the new phone (Instructure). Do it while the old iPhone still shows codes. Instructure only describes that button for optional MFA, so where it's required, ask your Canvas admin for a reset. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone instead; without one, you'll scan a new QR code. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use one of your backup codes when Canvas asks for a code. Without them, the documented route is an admin at your school. An admin with permission can click Reset Multi-Factor Authentication on your user details (Instructure), and Instructure's student guide points locked-out users to that reset. Contact your school's Canvas or IT help desk. Instructure doesn't say what proof your school will ask for or how long it takes. See Lost the phone with your authenticator app?
Turning 2FA off
Instructure describes this only for schools where MFA is optional: click Disable Multi-Factor Authentication on your Settings page (Instructure). Remove the Canvas entry from Novaz afterwards: open it and tap Remove account.
