DeployHQ 2FA: how to set up an authenticator app

DeployHQ pushes code from your repositories to your servers, so a DeployHQ login can usually start a deployment to production. Its two-factor authentication (2FA) uses codes from an authenticator app on your phone. The setting isn't under the Settings tab inside your DeployHQ account, though. DeployHQ handles logins through a separate single sign-on service, DeployHQ Identity, at identity.deployhq.com, and that's where you turn 2FA on (DeployHQ).

2FA is optional unless an administrator of your DeployHQ account requires it. DeployHQ's help names Google Authenticator, but any authenticator app that makes 6-digit codes works the same way. This guide uses Authenticator App - Novaz on iPhone.

How we checked this guide: the DeployHQ steps come from DeployHQ's own support pages and blog, linked below, which we read on October 22, 2026. We haven't tested them on a DeployHQ account, and the screenshots on DeployHQ's 2FA page date from 2019, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

DeployHQ's support page describes these steps (DeployHQ):

1. Go to identity.deployhq.com and log in with your usual DeployHQ email address and password.
2. On the right-hand side, under Security Settings, open Two Factor Authentication.
3. DeployHQ shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're doing this on your iPhone, take a screenshot and add it with Choose a photo instead. See scanning a QR code on the same iPhone.
4. Type the 6-digit code that Novaz shows, then click Activate.
5. DeployHQ then shows a recovery token. Write it down and keep it away from your phone (more on this below).

DeployHQ's page doesn't say whether a text key is offered for people who can't scan the code. If one is shown, in Novaz tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?

An older DeployHQ blog post calls the sign-in service aTech Identity rather than DeployHQ Identity (DeployHQ). The support page says the same 2FA covers "DeployHQ and other aTech services."

Keep the recovery token safe

You get one recovery token at setup, and DeployHQ says it's the thing you'll need to reset 2FA if you lose your phone (DeployHQ). Its help doesn't mention a set of several backup codes or a way to make a new token later.

Novaz's keys stay on your iPhone unless you turn on iCloud backup or export a backup file, so this token is your way back in if the phone is lost without a current Novaz backup. Store it in a password manager or on paper somewhere safe. See 2FA backup codes.

If your account requires 2FA

Account administrators can make 2FA mandatory: under Settings > Account & Access, they tick Require all users to have two factor authentication enabled?. After that, anyone who logs in without 2FA is asked to set it up. In User Management, a shield icon marks users who have it on, and a crossed-out shield marks those who don't (DeployHQ). An older DeployHQ blog post says to click Update account after ticking the box (DeployHQ).

On Enterprise plans that enforce SAML single sign-on, people sign in through their company's identity provider instead. DeployHQ turns off the 2FA requirement automatically in that case, and your company's own sign-in rules apply (DeployHQ).

If DeployHQ rejects your code

DeployHQ's help doesn't cover rejected codes. The usual cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

If you lose your authenticator

DeployHQ documents a three-step recovery (DeployHQ):

1. On the page that asks for your 2FA code, click Recover my account.
2. DeployHQ emails you a first code. Enter it and click Continue.
3. Enter the recovery token you saved when you set up 2FA, and click Continue.

That resets 2FA, so set it up again afterwards. You need both the email inbox and the token. DeployHQ's 2FA page doesn't say what to do without the token. Its password reset page says to contact DeployHQ's support team with the account's email address if you still can't get in, but it doesn't mention 2FA or say what proof is asked for (DeployHQ). More in Lost the phone with your authenticator app?

Changing phones or turning 2FA off

To turn 2FA off, go back to the Two factor authentication page in DeployHQ Identity, open your authenticator app, and enter the current code. DeployHQ says 2FA is turned off right away (DeployHQ). If your account requires 2FA, you'll be asked to set it up again at your next login.

DeployHQ doesn't describe a separate way to move 2FA to a new phone. While you still have the old iPhone, you can turn 2FA off and set it up again on the new one, which also gives you a new recovery token. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and skip the reset; without one, this is the way to do it. See How to transfer your authenticator app to a new iPhone.

Official DeployHQ help

• Setting up two factor authentication (2FA)
• Account and Access
• Setting up SAML Single Sign-On (SSO)
• Resetting your password
• Increase your DeployHQ account security using two factor authentication