Cardmarket 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Cardmarket is where many collectors buy and sell Magic, Pokémon and other trading cards with each other, so your account involves real money. Two-factor authentication (2FA) is optional, but Cardmarket's help urges everyone to use it, sellers most of all (Cardmarket, Cardmarket). The only method it describes is a code from an authenticator app: it suggests Google Authenticator or Authy, but any OTP-compatible app works.
Two things stand out. You choose which actions need a code, and there are no backup codes in the help: lose your phone and you get back in with a photo ID. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Cardmarket steps come from Cardmarket's own help center at help.cardmarket.com, linked below, which we read on October 20, 2026. We haven't tested them on a Cardmarket account, so a label may differ slightly. The help doesn't name every button, and cardmarket.com's account pages didn't load for our check, so expect a screen the steps don't mention. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Cardmarket's help describes this order (Cardmarket):
- Log in to your Cardmarket account on the website.
- Click the icon with your username and open your Account page.
- Choose the Security tab on the left side. It has a short explanation of 2FA and how to set it up.
- Cardmarket shows a QR code. In Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code from Novaz (the help calls it the "token") into the field on Cardmarket. That activates 2FA.
The help mentions only the QR code, not a text key, and doesn't give the code length or interval. So scan if you can: the QR code carries the exact settings. A key typed with Enter key manually gets standard 6-digit, 30-second codes. See What is a 2FA setup key?
A warning from Cardmarket: fake support messages sometimes ask users to scan a QR code, and Cardmarket never contacts you through private messages (Cardmarket). Only add the QR code from your own Security tab.
Choose which actions need a code
After setup, the Security tab lets you set which actions ask for 2FA. The actions Cardmarket recommends are already selected by default (Cardmarket). The help doesn't list them in writing; its 2FA page has a Cardmarket video on customizing them instead.
When you log in with 2FA on a new device, you can add it as a trusted device. Cardmarket remembers it for 30 days and doesn't ask it for a code in that time. You manage trusted devices on the same tab.
No backup codes
Cardmarket's help doesn't mention backup or recovery codes or a second method. So back up Novaz with iCloud backup or a backup file. If the phone is gone and you have neither, the photo ID route below is your way back in.
If Cardmarket rejects your code
The help has no advice for codes that don't work. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
Cardmarket doesn't document moving 2FA to another phone. Its help does cover turning 2FA off and on in the Security tab, so while the old phone still works, turn 2FA off, then set it up again on the new phone with a fresh QR code. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Cardmarket's help and FAQ give two routes (Cardmarket, Cardmarket):
- Cardmarket asks for a code when you log in. On the code screen, click Contact Us (the FAQ spells it Contact us). That takes you to the Lost Device page, where you send Cardmarket a message with a valid photo ID. Cardmarket then turns off 2FA on your account.
- You had switched 2FA off for logging in. You can still log in as usual. Then go to the Lost Device page to have 2FA turned off.
Neither page says how long this takes. Cardmarket support works Monday to Friday, 8:00 to 18:00 (UTC+2), and says replies currently take three to five working days (Cardmarket). For other log-in problems, the FAQ points to contact@cardmarket.com. Once you're back in, set up 2FA again on your new phone. See Lost the phone with your authenticator app?
Turning 2FA off
You can turn off 2FA on the Security tab, though Cardmarket advises against it (Cardmarket). The help doesn't name the button or say whether you need a code to do it. Then clear the old entry out of Novaz: open it and tap Remove account.
