Cloudflare 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Cloudflare account signs you in to the dashboard, where you manage your domains and DNS. Even without two-factor authentication (2FA), Cloudflare emails you a code when someone signs in with your password from an unknown IP address. Turning on 2FA is the only way to switch that email check off (Cloudflare).
Cloudflare's 2FA methods are an authenticator app (Mobile App Authentication), a security key or built-in authenticator such as Touch ID, and email codes. It recommends setting up at least two (Cloudflare). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Cloudflare steps come from Cloudflare's own documentation, linked below, which we read on October 20, 2026. We haven't tested them on a Cloudflare account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- Verify your email address. 2FA only works with a verified email, and Cloudflare warns that skipping this can lock you out (Cloudflare). On My Profile, a verified address shows
(verified). If yours doesn't, select Send verification email (Cloudflare). - Signed up with Apple, Google or GitHub? Your profile may have no password yet, and 2FA needs one. Set it through the Forgot Password page (Cloudflare).
- Your company uses single sign-on: you can't change your Authentication settings (Cloudflare).
- Joining someone else's account: a Super Administrator can turn on 2FA Enforcement, and then members have to turn on 2FA before accepting the invitation (Cloudflare).
Turn on 2FA with an authenticator app
Cloudflare's 2FA page gives these steps (Cloudflare). It names the profile My Profile, Profile or User Profile in different places, so your labels may differ.
- Sign in to the Cloudflare dashboard and open My Profile from the profile menu.
- Select Authentication. If you see Set up under Two-Factor Authentication, select it.
- Under Mobile App Authentication, select Add.
- In Novaz, tap +, then Scan QR code, and point the camera at Cloudflare's QR code. If it's on the same iPhone, take a screenshot and use Choose a photo (how).
- Type the code from Novaz into Cloudflare, enter your password and select Next. Cloudflare asks for the password a second time.
- Select Next to see your backup codes, save them with Download, Print or Copy, then select Next to finish.
Can't scan? Select Can't scan QR code, Follow alternative steps. Cloudflare doesn't describe what those steps show. If you get a text key, tap + in Novaz, then Enter key manually, and type it as the Setup key (setup keys). A typed key always gives 6-digit codes every 30 seconds, and Cloudflare doesn't say which interval it uses, so scanning is safer.
Keep your backup codes
Each backup code works once (Cloudflare). If your iPhone is gone and you have no Novaz backup to restore, these codes are your way in. Keep them in a password manager or on paper.
For a fresh set, go to My Profile > Authentication, select Manage for Two-Factor Authentication, then Regenerate for Backup codes. The old codes stop working. See 2FA backup codes.
Signing in
After your password, Cloudflare shows a Two-Factor Authentication page. Type the code from Novaz there. A backup code goes in the same box, followed by Log in. If the page asks for a security key instead, cancel the browser prompt and select try another authentication method or backup code (Cloudflare). Cloudflare doesn't say whether it remembers devices you've used before.
Signing in with Apple, Google or GitHub doesn't skip this step (Cloudflare).
If Cloudflare rejects your code
Cloudflare's pages don't cover rejected codes. Check two things:
- Your iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
- An old entry. If you've set up the authenticator app again on Cloudflare, codes from the earlier setup no longer work (Cloudflare). Use the newest Cloudflare entry in Novaz and remove the old one: open it and tap Remove account.
More causes are in Authenticator code not working?
Changing phones
Cloudflare's way is to run the authenticator setup again with the new phone. 2FA stays on, and the old phone's codes stop working (Cloudflare). Unless you have a Novaz iCloud backup or backup file to restore on the new iPhone, do this while the old phone still works. See moving to a new iPhone.
If you lose your authenticator
Use a backup code or another 2FA method you've added. Without either, account recovery only works from a device that has signed in before (Cloudflare):
- Sign in, and on the Two-Factor Authentication page select Try recovery next to Lost all 2FA devices and backup codes?, then Begin recovery.
- Enter the access code Cloudflare emails you and select Verify email.
- Select Verify device.
If you see Device verified, Cloudflare emails you instructions within 3-5 days and says "this process cannot be expedited" (Cloudflare).
If you see Device verification failed, try another device you've used before, or choose Request manual verification. Cloudflare doesn't say what that asks for or how long it takes. See Lost the phone with your authenticator app?
Turning 2FA off
You have to delete every security key and authenticator app on your profile. For the app, select Delete method on the Mobile App Authentication card, enter your password, a code from Novaz or a backup code, and select Disable (Cloudflare). Under 2FA Enforcement, members who aren't Super Administrators may not be allowed to. Then remove Cloudflare from Novaz.
