cron-job.org 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
cron-job.org is a free service that calls your URLs on a schedule, so your account holds every job that keeps a site's scheduled tasks running, plus your API keys. It calls its two-factor protection multi-factor authentication (MFA), and it's optional. You can add an authenticator app, a YubiKey that types Yubico OTP codes, or both (cron-job.org, cron-job.org Blog). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the cron-job.org steps come from cron-job.org's own pages, linked below, which we read on October 22, 2026. Its documentation on this is short: one blog post from December 2021 with a screenshot of the settings. We haven't tested the steps on a cron-job.org account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Where the setting is
There's no switch called "two-factor" to look for. cron-job.org treats each authenticator as a device on your account. The announcement says to sign in to the Console, open Settings, and add your first MFA device (cron-job.org Blog). In the screenshot that comes with it, the card is called Multi-Factor Authentication devices, and each entry has a Title and a type, such as Authenticator app (TOTP).
Add an authenticator app
- Sign in to the cron-job.org Console and open Settings.
- Find the Multi-Factor Authentication devices card and choose Add device (the screenshot shows it in capital letters).
- Pick the authenticator app option and follow the setup screen. The list shows a Title for each device, so expect to give this one a name, such as the model of your iPhone.
- If you see a QR code, open Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you're given a text key instead, tap +, then Enter key manually, and type it into Setup key. Put cron-job.org in Service. See What is a 2FA setup key?
- Type the current code from Novaz if cron-job.org asks you to confirm it.
cron-job.org's pages don't show the setup screen itself, so we can't tell you its button labels, whether it offers a text key, or how often its codes change. When there's a QR code, scan it: that hands Novaz the exact code settings. A key typed by hand always gets 6 digits every 30 seconds.
The announcement names Google Authenticator and Microsoft Authenticator only as examples of TOTP apps (cron-job.org Blog). Novaz makes the same kind of time-based codes.
No backup codes in the docs
None of cron-job.org's public pages mention backup or recovery codes. What the screenshot does show is an account with two devices listed at once, an iPhone authenticator and a YubiKey. So an account can hold more than one. The pages don't say whether any one of them is enough at sign-in, or call a second device a backup. Still, with no codes to fall back on, a second device added while you can still sign in is the closest thing to one: a YubiKey if you have it, or an authenticator app on another device.
API keys aren't covered
According to the REST API docs, each request needs only an API key, no sign-in code. You create keys in the Console under Settings, and cron-job.org's docs warn that a key gives access to your account just as a password does (cron-job.org). The API docs don't mention MFA at all, so don't count on it to protect a leaked key. If you use the API, keep the keys private and use the IP address restriction the docs recommend.
If cron-job.org rejects your code
The official pages don't give any advice for rejected codes. Start with your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also make sure you're using the cron-job.org entry, if you have several. Other causes are in Authenticator code not working?
New phone, lost phone, or removing a device
To retire an authenticator, the screenshot shows a Delete button next to each device in the list (cron-job.org Blog). The pages don't say whether deleting asks for a code or whether removing the last device turns MFA off.
When you move to a new iPhone, add it as a new device while the old phone still works, then delete the old entry. With iCloud backup or a backup file, you can instead restore your Novaz accounts on the new iPhone, and the existing entry keeps working. See How to transfer your authenticator app to a new iPhone.
If you've already lost the phone and have no other device on the account, cron-job.org doesn't publish a recovery process. Its contact page gives info@cron-job.org as the email address and says the phone number is not a support hotline (cron-job.org). It doesn't say what proof it would ask for or how long a reset would take. Writing from the email address on your account is the obvious place to start. More in Lost the phone with your authenticator app?
Official cron-job.org help
- Added support for Multi-Factor Authentication (cron-job.org Blog)
- Free cronjobs - from minutely to once a year. (home page, features list)
- REST API (cron-job.org documentation)
- Contact
