Customer.io 2FA: how to set up an authenticator app

Companies use Customer.io to send email, push and SMS messages to their customers, and your login is one team member on your company's account. Unless your company uses single sign-on (SSO), two-factor authentication (2FA) is already on: after your password, Customer.io emails you a magic link (Customer.io).

An authenticator app can replace that link, but an Account Admin turns it on for the whole team, not one person at a time (Customer.io). We use Authenticator App - Novaz on iPhone in the steps, but any authenticator app works the same way.

How we checked this guide: the Customer.io steps come from Customer.io's own documentation, linked below, including the screenshots on those pages, which we read on October 20, 2026. We haven't tested them on a Customer.io account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Email link or authenticator app

The email link only works on the same device and in the same browser where you typed your password (Customer.io).

Once an Account Admin requires an authenticator app, everyone uses app codes instead, including people invited later, and anyone not yet set up can't keep working until they are. Admins see each person's method in the 2FA column of Team Members, but can't change it for one person (Customer.io, Customer.io).

Signing in with a personal Google account rather than company SSO still means the email link by default, though the SSO page says you can switch to an app in your settings (Customer.io).

Turn on 2FA with an authenticator app

If you're an Account Admin, start with your own login (Customer.io):

1. Go to Settings > Account Settings > Team Members and click Edit your settings.
2. Under Two Factor Authentication (2FA) via Authenticator App, click Manage, then Enable.
3. Save your ten recovery codes with Download, Print or Copy, then click Next.
4. Customer.io shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. Type the code from Novaz into the box on that page.
6. Now require it for everyone: go to Settings > Account Settings > Security and click Enable Auth App. The button stays unavailable until you've finished steps 1 to 5 on your own login.

If you're a team member, wait for the admin. Your next visit then opens a Required Two-Factor Authentication screen with the same two steps, recovery codes first and then the QR code. Follow steps 3 to 5 above.

Customer.io says you can also type the code into your app by hand, but doesn't name the text key or say how many digits or seconds its codes use. Scanning is safer, because the QR code carries those settings. If you do type a key, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?

Recovery codes

Each of the ten codes works once. To see them again or make a new set, open Edit your settings, then Manage under the authenticator app setting, and use View backup codes. If you generate new ones, throw away the old list (Customer.io).

Without iCloud backup or a backup file, Novaz keeps its keys only on your iPhone, so these codes are your way back in. Keep them away from the phone. More in 2FA backup codes.

When Customer.io asks for a code

You type a code after your email address and password, in the Authentication code box, then click Sign in. Sessions last 14 days by default. An admin can shorten them to as little as one hour under Login session expiration on the Security settings page (Customer.io).

If Customer.io rejects your code

Customer.io's documentation has no advice on rejected app codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

If you lose your authenticator

Customer.io lists three routes, in this order (Customer.io):

1. A recovery code. Type it in the Authentication code box instead of an app code.
2. Another Account Admin. They remove you on the Team Members page and add you again. You set a new password and set up the authenticator from scratch. No account data is tied to a team member login, so nothing is lost, and the old authenticator stops working (Customer.io).
3. Customer.io support. Email win@customer.io from the address you sign in with. Support verifies your account details and identity first. Customer.io says this can take longer, but gives no timeframe.

If you're the only Account Admin, nobody on your team can reset you, so guard your recovery codes. See Lost the phone with your authenticator app?

Changing phones

Customer.io doesn't document a phone switch. If you use iCloud backup or a backup file in Novaz, restore your accounts on the new iPhone and the codes keep working. Without one, the documented resets are the two above, another Account Admin or support, so arrange one before you wipe the old phone. See How to transfer your authenticator app to a new iPhone.

Turning it off

A screenshot shows a Disable button on the personal page, but the docs don't say what it does while the app is required. Admins moving the account to SSO must first turn off Customer.io's 2FA requirement; the identity provider then takes over (Customer.io).

Official Customer.io help

• Two-factor authentication
• Security
• Session cookies and expiration
• Security best practices
• How to add team members
• Single sign-on (SSO)