Cobalt 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Cobalt is a pentest-as-a-service platform, and its app at app.cobalt.io is where security teams follow pentests and findings. Whether you deal with two-factor authentication (2FA) there depends on how you sign in. If you use your email address and password, Cobalt's account settings page says you can't get into the account until 2FA is set up, and the app asks you to do it right after you sign in (Cobalt). If you sign in through SAML single sign-on or with Google, Cobalt's 2FA doesn't apply to you at all.
The only second factor Cobalt documents is an authenticator app, backed up by a single recovery code. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Cobalt steps come from Cobalt's own documentation at docs.cobalt.io, linked below, which we read on October 21, 2026. We haven't tested them on a Cobalt account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Who needs it
- Email and password sign-in: required, according to Cobalt's account settings page (Cobalt).
- SAML SSO or Google sign-in: not needed. Your identity provider or Google handles the extra check (Cobalt).
Cobalt's pages don't fully agree. The sign-in article still treats 2FA as something an organization may enforce, but the organization settings page shows no such switch, only SAML and SCIM options (Cobalt). Either way, expect to be asked.
Turn on 2FA with an authenticator app
If Cobalt prompts you after you sign in, follow the screen. Otherwise, start from your profile (Cobalt):
- In the Cobalt app, select your profile icon, then Security Settings on the user menu. The direct address is app.cobalt.io/settings/security/2fa.
- Follow Cobalt's on-screen instructions to add an authenticator. Cobalt names Authy and Google Authenticator as examples, but it lets you pick any app.
- When Cobalt shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Cobalt's documentation doesn't say whether it also shows a text key you can type. If you find one, tap + in Novaz, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key?
- Cobalt's page doesn't list the remaining screens. Complete them, typing the current code from Novaz if Cobalt asks for one, and select Continue.
- Cobalt now shows your recovery code. Save it before you close that overlay, because Cobalt won't show it again.
Afterwards, the authenticator appears as a device on your account security page (Cobalt).
One recovery code, not a list
Many services give you ten backup codes. Cobalt gives you one. Its glossary describes the recovery code as the way back in if you lose your device or authenticator app (Cobalt). When you use it, Cobalt asks you to save a new one before it lets you in (Cobalt). So after any recovery, replace the old code wherever you keep it.
Without a Novaz iCloud backup or backup file, the keys exist only on your iPhone, so that recovery code is your way back in. Store it somewhere other than the phone, such as a password manager or a printed sheet. More in 2FA backup codes.
When Cobalt asks for a code
You enter a code from your authenticator when you sign in. At that step you can select Remember this device for 30 days, which covers one device and one browser. Switching browser or network, clearing cookies, incognito mode, or another person signing in on that browser all bring the prompt back (Cobalt).
If Cobalt rejects your code
Cobalt's advice is to type the code quickly, within the 30 seconds it's shown, and to make sure the phone's time is right. If you set your phone's time zone by hand, switch back to the system time zone (Cobalt). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Do this while you're still signed in, or from a browser you marked to remember. Go to app.cobalt.io/settings/security/2fa, select Manage under Two-Factor Authentication (2FA), find the old device and select the trash icon. Then add the new phone as a fresh 2FA device (Cobalt). If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead; without one, the new phone needs this fresh setup. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
You have two routes (Cobalt):
- Your recovery code. Sign in with your email and password. Under Verify Your Identity, select Try another method, then Recovery code, and enter it. Save the new code Cobalt gives you, then set up 2FA again.
- Your Organization Owner. Ask them to turn off 2FA on your account. They do it on the People page: the three-dot icon next to your name, then Turn Off 2FA, then Confirm. Cobalt suggests they check who you are first. You get an email once it's done and can sign in without a code.
If you're the only Organization Owner, contact your Customer Success Manager or support@cobalt.io. Cobalt doesn't say what proof it asks for or how long that takes. More in Lost the phone with your authenticator app?
Turning it off
Cobalt advises against it. The only documented ways to remove the authenticator are deleting the device yourself, as above, or asking an Organization Owner.
