Cloudinary 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Cloudinary is the media platform developers and marketing teams use to store, transform and deliver images and video. Your login opens the Cloudinary Console, which also holds your API keys, so it's worth protecting. Cloudinary recommends two-factor authentication (2FA) for any production environment, and it's available on every plan, free accounts included (Cloudinary).
There's a catch for people who signed up with Google or GitHub: Cloudinary's 2FA only protects the email and password login, so you need to set a Cloudinary password first (Cloudinary). The codes come from an authenticator app. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Cloudinary steps come from Cloudinary's own documentation, linked below, which we read on October 21, 2026. We haven't tested the steps on a Cloudinary account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start: set a password if you use Google or GitHub
If you signed up with Google, GitHub, or through a marketplace add-on such as Heroku, set a password for direct email login first. Cloudinary says this step is required to turn on 2FA (Cloudinary):
- Open Settings, then the My Profile page, and click Set Password. Some accounts show Set Direct Access instead.
- In the Set Password dialog, click Get Code, then paste the verification code Cloudinary emails you.
- Type a new password with a capital letter, a lowercase letter, a number and a special character, and type it again to confirm.
If the password is missing a required character or the two entries don't match, you have to request a new email code. Accounts created through Heroku or another marketplace should open the Console from that provider's portal first.
Turn on 2FA with an authenticator app
- In the Cloudinary Console, open Settings, then My Profile.
- Open the Two-Factor Authentication tab (Cloudinary).
- Cloudinary shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the Console is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Type the code from Novaz to finish.
Cloudinary's documentation doesn't list the buttons on that tab, or whether it shows a text key next to the QR code. It does show what the QR code holds: a link that starts with otpauth://totp/ and carries your key after secret=, with Cloudinary as the issuer (Cloudinary). That page is meant for phones with a broken camera. If you ever need to type the key, in Novaz tap +, then Enter key manually, and paste the part after secret= as the Setup key. See What is a 2FA setup key?
Team accounts and SSO
Admins can make 2FA a requirement for everyone from the Account Security page of the Console Settings. When it's set to Optional, Cloudinary won't ask anyone to set it up, but each person can still turn it on under My Profile (Cloudinary).
If your company signs you in to Cloudinary through SAML single sign-on, Cloudinary ignores its own 2FA setting and trusts your identity provider. Any second step comes from your company's sign-in instead (Cloudinary).
Backup codes
Cloudinary's documentation doesn't say whether you get backup or recovery codes. If the setup screen offers any, save them somewhere other than your phone. Without a Novaz iCloud backup or backup file, the keys exist only on your iPhone, so those codes would be your spare way in. More in 2FA backup codes.
If Cloudinary rejects your code
Cloudinary's pages give no advice on rejected codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones or losing your authenticator
Cloudinary doesn't describe how to move 2FA to a new phone, how to turn it off, or how to get back in without your codes. On the Novaz side, an iCloud backup or backup file lets you restore your accounts on the new iPhone. Without one, keep the old phone until Cloudinary is set up on the new one: look on the Two-Factor Authentication tab while you're signed in, or ask Support. See How to transfer your authenticator app to a new iPhone.
If you're already locked out, Cloudinary's documentation sends all account questions to Support through a support ticket (Cloudinary). For sensitive requests, Support may ask for a support verification code. You generate it on the Support Verification Code tab of My Profile, and Cloudinary emails it to the address on your account (Cloudinary). Cloudinary doesn't say what proof it needs when you can't sign in, or how long a reset takes.
On a team account, an admin can reset your password or force a logout from User Management, but Cloudinary doesn't say an admin can reset someone's 2FA (Cloudinary). More in Lost the phone with your authenticator app?
