Clio 2FA: how to set up an authenticator app

Clio is legal practice software. One Clio sign-in covers Clio Manage, for matters and billing, and Clio Grow, for client intake. Two-factor sign-in, which Clio calls multi-factor authentication (MFA), stopped being optional in January 2026. If you haven't set it up yet, Clio asks you to do it the next time you sign in (Clio).

Clio offers three kinds of second step: a push prompt in the Clio for Law Firms and Lawyers mobile app, a text message, or a code from an authenticator app or password manager (Clio). This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Clio steps come from Clio's own help center, linked below, which we read on October 21, 2026. The help center's web pages blocked automated requests, so we read the same articles through the help center's public article feed on help.clio.com. We haven't tested the steps on a Clio account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on MFA with an authenticator app

Start in either product: turning MFA on in Clio Manage also turns it on in Clio Grow, and the other way around (Clio).

1. Open the security settings:
   • Clio Manage: go to Settings > Security & Compliance, and under My Security, click Update your security settings.
   • Clio Grow: go to Settings > Personal, and in the Security section, click Manage my security.
2. Scroll to Multi-factor authentication and click Set up multi-factor authentication.
3. Enter your Clio password and click Continue.
4. Choose Authenticator app and click Continue.
5. Clio shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If Clio is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
6. If you'd rather type it, Clio also offers a secret key. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. Clio's six-digit, 30-second codes match what Novaz uses for a typed key. See What is a 2FA setup key?
7. Back in Clio, click Continue, type the six-digit code from Novaz, and click Continue again.
8. Click Done, then download your backup codes (next section).

Download your backup codes

Clio's emergency backup codes work once each (Clio). Under Multi-factor authentication in the same settings, click Download next to Backup codes and enter your password.

Keep them off your phone. Unless you've turned on iCloud backup or saved a backup file in Novaz, its keys stay on that iPhone, so these codes are your way back in if the phone is gone. To use one, sign in as usual, click Use backup security code under Security code, and type it in the Emergency backup code field, not the regular code field. More in 2FA backup codes.

If you run out, a firm administrator who resets your MFA also gives you a new set (Clio).

When Clio asks for a code

Clio asks for the code after your password. Tick Keep me logged in for a week there to skip the prompt on that browser for a week (Clio).

If Clio's mobile app is installed with notifications on, signing in to Clio Manage on the web sends a push prompt to the phone by default. The help page doesn't explain how to pick the authenticator code instead on that screen.

If Clio rejects your code

Clio's own advice is to check that the device where you type the code and the phone that shows it have the same time and time zone. Otherwise Clio may treat the code as expired (Clio). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

New phone or lost authenticator

Clio suggests these steps, in this order (Clio):

1. See if you're still signed in. A week-long session may still be active. If so, add Clio to your new phone from your security settings. The help doesn't show the screens for replacing an authenticator.
2. Use a backup code to sign in.
3. Ask a firm administrator to reset your MFA. They use Reset MFA under Firm Security, and you get an email to set it up again. Administrators can't reset the primary subscriber's account (Clio).
4. Use Clio's identity check. If nothing else works, for example in a one-person firm, Clio's recovery link starts a check through an identity service called NameTag. You need access to your account's email address, a device with a camera, and government-issued photo ID with the same legal name as your Clio account. Clio tells your firm's primary subscriber about the request by email. Verification can take a few hours, and Clio says processing can take up to two business days. If the check fails, Clio emails you to work out another way to verify with its support team.

With Novaz's iCloud backup or a backup file, you can restore Clio and your other accounts on a new iPhone. Without one, a new phone means adding Clio again, so do it while you can still sign in. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?

Turning MFA off

MFA is required, and Clio's help doesn't describe turning it off. Once Clio uses another method or an administrator has reset yours, open Clio in Novaz and tap Remove account.

Official Clio help

• Set Up Multi-Factor Authentication
• Multi-Factor Authentication Account Recovery
• Multi-Factor Authentication Settings for Administrators