Cliniko 2FA: how to set up an authenticator app

Cliniko is practice management software for clinics, and every staff member signs in with their own email and password. Two-factor authentication (2FA) adds a code from an authenticator app. It's optional for each user, but an administrator can make it compulsory for everyone, and any clinic that connects Cliniko to Xero has to turn on that account-wide rule (Cliniko, Cliniko). The help pages describe no second factor other than an authenticator app. They suggest Twilio Authy, but say any 2FA app will do (Cliniko). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Cliniko steps come from Cliniko's own help center, linked below, which we read on October 21, 2026. We haven't tested them on a Cliniko account, so a label may differ slightly. Most of these articles were last updated in 2023 or 2024. The Novaz steps are checked against the app, version 1.0.5.

Before you start: check your mobile number

Cliniko asks you to make sure the mobile number in your profile is current before you turn on 2FA. It uses that number to confirm who you are if your 2FA ever needs to be reset, and its help says 2FA can't work without it (Cliniko, Cliniko).

Turn on 2FA with an authenticator app

If your administrator already requires 2FA, Cliniko shows an alert the next time you sign in, and you have to finish these steps before you can do anything else. Otherwise, start them yourself (Cliniko):

1. In Cliniko, open My info. It's under your name in the menu.
2. In the two-factor authentication section, select Enable 2 factor authentication.
3. Cliniko shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If Cliniko is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. If you can't scan it, Cliniko lets you enter the key manually and shows a code to copy. Cliniko's help doesn't give that key a name. In Novaz, tap +, then Enter key manually, type "Cliniko" as the Service, and paste the key as the Setup key. See What is a 2FA setup key?
5. Type the current 6-digit code from Novaz into the verification code field on Cliniko's 2FA page.
6. Select Enable 2 factor authentication at the bottom of the page.

Cliniko's codes change every 30 seconds, which matches what Novaz makes from a typed key (Cliniko).

Make your backup codes right away

Cliniko's setup article treats backup codes as a separate step: go back to the 2FA section of My info and select Generate backup codes. Each code works once. Print them or save them somewhere safe away from your phone (Cliniko).

Without a Novaz backup (iCloud backup or a backup file), the keys exist only on your iPhone, so these codes are your way in if that phone is gone. Every time you turn 2FA off and on again, the old codes stop working and you need a new set (Cliniko). More in 2FA backup codes.

Cliniko's help also advises keeping 2FA codes in a separate app from your passwords, so that a breach of your password manager doesn't expose both (Cliniko).

When Cliniko asks for a code

You sign in with your email and password, then type the 6-digit code from Novaz. Cliniko asks for it on any browser or device it doesn't recognize. If you tick Keep me logged in on this device on the code screen, it stops asking on that browser for 30 days (Cliniko).

That memory belongs to one browser on one device. You'll be asked again if you:

• use a different browser, even on the same computer,
• clear the browser's history or cookies, or
• reset your Cliniko password, which forgets every remembered browser.

If Cliniko rejects your code

Cliniko says the usual cause, when nothing about your setup has changed, is the time on your phone, and that it should be set to automatic (Cliniko). On iPhone, that's Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

If the clock is right and the codes still fail, Cliniko suggests signing in with a backup code, then turning 2FA off and on again for a fresh setup (Cliniko). More causes are in Authenticator code not working?

Changing phones

Cliniko's easiest route for a new phone is to sign in with a backup code, turn 2FA off, and set it up again on the new phone (Cliniko). A code from the old iPhone works for signing in too, if you still have it. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead; without one, the new phone gets Cliniko from a fresh QR code. See How to transfer your authenticator app to a new iPhone. Then generate new backup codes, and remove Cliniko from Novaz on the old phone with Remove account.

If you lose your authenticator

1. Use a backup code. Then turn 2FA off and on again with your new phone, and save the new backup codes (Cliniko).
2. No backup codes, or none of them work? Used codes, and codes from before your last setup, don't work. Look for a newer saved set.
3. Ask your clinic's Cliniko owner or an administrator. They can turn off 2FA for you, so you can sign in with your email and password and set it up again.

Cliniko's help doesn't say how long this takes, and doesn't describe a route for an owner with no other administrator. For 2FA problems it doesn't cover, it points you to its support team through the chat icon (Cliniko). More in Lost the phone with your authenticator app?

Turning 2FA off

Cliniko's recovery article talks about disabling and re-enabling 2FA from your 2FA settings, but doesn't name the button. If your administrator requires 2FA for everyone, you'll have to set it up again the next time you sign in. Only administrators can change that rule, under Settings > General settings > Security > Two factor authentication (Cliniko).

Official Cliniko help

• Set up 2 factor authentication (2FA)
• Recovering your account if you lose your 2FA codes
• Using 2FA and the keep me logged in option
• 2 factor authentication (2FA): general FAQs
• Require all users on your account to use 2-factor authentication
• Why do I need to enable 2FA to use my Xero integration?
• How to switch from Twilio Authy desktop app to mobile