Delinea 2FA: how to set up an authenticator app

Delinea makes privileged access software that companies use to store and share admin passwords. You don't sign up for a Delinea account yourself: your employer gives you one, either on the cloud-based Delinea Platform or on a Secret Server that your company runs or rents. So you can't switch on two-factor authentication (2FA) yourself: an administrator turns it on, and Delinea asks you to enroll at your next sign-in. Your organization may use other second steps instead, such as Duo, FIDO2 security keys, RADIUS tokens or email codes (Delinea).

This guide covers the authenticator-app option. We use Authenticator App - Novaz on iPhone in the steps, but any time-based authenticator app works the same way. Delinea says any app built on the TOTP standard (RFC 6238) is compatible (Delinea).

How we checked this guide: the Delinea steps come from Delinea's own documentation site, linked below, which we read on October 21, 2026. The Secret Server pages are marked as version 12.3.x. We haven't tested them on a Delinea account, and your administrator's settings can change what you see, so a label may differ. The Novaz steps are checked against the app, version 1.0.5.

Which Delinea are you signing in to?

• Delinea Platform: the cloud sign-in that also hosts Secret Server Cloud. Two-factor rules come from your organization's identity policies, and the authenticator is called an OATH OTP client (Delinea).
• Secret Server on its own: an on-premises or stand-alone cloud install. The authenticator option there is called TOTP Authenticator (Delinea).

Set up an authenticator on the Delinea Platform

Your administrator has to add an OATH OTP client challenge to the identity policy that applies to you. They can also make enrollment mandatory with Require users to configure at sign-in, and they pick the name you'll see for this option. Delinea's example name is Google Authenticator, so the screen may show that name even though you use Novaz (Delinea).

Delinea describes the enrollment like this (Delinea):

1. Sign in with your username and password. If you're new, accept the invitation email first and set a password.
2. When Delinea asks you to enroll your OTP client, it shows a QR code.
3. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. Follow the remaining prompts to finish.

Delinea's documentation doesn't show the enrollment screens or say whether they offer a key to type by hand. Scan the QR code if you can. Delinea notes that the key algorithm, number of digits and code period are all OATH settings that a QR code normally fills in (Delinea). Novaz reads them from the QR code. A key typed with Enter key manually always gets 6 digits every 30 seconds, so it works only if your organization uses those defaults. See What is a 2FA setup key?

Later, you can check your sign-in methods yourself. Select your user icon at the top right, choose Account Details, and open the Security tab. Each card is a method, and you can select one to set it up or change it (Delinea).

Set up an authenticator in Secret Server

In a stand-alone Secret Server, an administrator opens Users from the Admin menu, ticks your name, and chooses Enable TOTP Auth Two Factor from the < Select Bulk Operation > list. You then have to complete the setup with your phone the next time you sign in to Secret Server (Delinea). Administrators can also switch it on automatically for new users from an Active Directory domain (Delinea).

The current pages don't show that setup screen. Delinea's general description says you either scan a QR code or type in a secret key from Secret Server (Delinea). In Novaz, scan with + > Scan QR code, or tap + > Enter key manually and paste the key into Setup key.

After that, Secret Server asks for a code from your app every time you sign in (Delinea).

Secret Server can also store one-time code keys for the websites saved in it. That's a separate feature for other accounts. Delinea's pages don't address keeping your own Secret Server sign-in key in there, but it would leave you without a code whenever you can't get into Secret Server, so keep that key in Novaz.

Backup codes

None of the Delinea pages we read describe backup or recovery codes for signing in. Without iCloud backup or a backup file, Novaz keeps its keys only on your iPhone, so your fallback is your administrator (below).

If Delinea rejects your code

On Secret Server, Delinea's troubleshooting page puts failed codes down to clocks: the server's clock and your phone's have to agree. Its fixes are on the server side: syncing the web servers to a reliable time source, or a setting, off by default, that accepts slightly early or late codes (Delinea).

Check your end first: on your iPhone, Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If your phone is right and codes still fail, tell your administrator. More causes are in Authenticator code not working?

Lost your phone or getting a new one

Both mean asking your administrator. In Secret Server, they select you under Users and run Reset TOTP Auth Two Factor from the bulk operation list. You then set up the authenticator again at your next sign-in (Delinea). For the Delinea Platform, the pages we read don't describe a lost-device reset, so contact your company's Delinea administrator or help desk.

For a new phone, restoring Novaz from iCloud backup or a backup file keeps your Delinea codes working without a reset. Without one, plan the move with your administrator before you wipe the old phone. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?

Turning it off

Only an administrator can. In Secret Server it's the same bulk list, with Disable TOTP Auth Two Factor (Delinea). Once it's off, open Delinea in Novaz and tap Remove account.

Official Delinea help

• OTP Client Authentication
• Managing Your User Profile
• TOTP
• Applications for Soft Token Two-Factor Authentication
• Enabling TOTP for Secret Server Users
• Resetting TOTP for Secret Server Users
• Disabling TOTP for Users
• TOTP MFA for Secret Server Accounts
• User Settings
• Security Hardening Guide
• Integrating Authy with Secret Server