Skip to content
Novaz AuthenticatorGET

DigitalOcean 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Choose backup codes
  3. When DigitalOcean asks for a code
  4. Teams that require secure sign-in
  5. If DigitalOcean rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official DigitalOcean help

Your DigitalOcean account is the login behind your Droplets, apps and databases, and the team that pays for them. Two-factor authentication (2FA) starts off, DigitalOcean strongly recommends it, and a team owner can require it. But DigitalOcean's own 2FA exists only if you sign in with an email address and password. If you sign in with Google or GitHub, the second step belongs to that account instead (DigitalOcean). The Sign-in method section of your My Account page shows which you use (DigitalOcean).

You pick a main method (an authenticator app, which DigitalOcean recommends, or text messages) and then a backup method. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the DigitalOcean steps come from DigitalOcean's own documentation and support articles, linked below, which we read on October 20, 2026. We haven't tested them on a DigitalOcean account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

From DigitalOcean's documentation (DigitalOcean):

  1. In the DigitalOcean Control Panel, click your profile icon in the top right corner, then My Account.
  2. Scroll to Two-factor authentication and click Set Up 2FA.
  3. In the Set up two factor authentication window, under Choose Method, pick the authenticator app.
  4. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. On the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  5. Can't scan? Click Try this instead under the QR code for a code to type. In Novaz, tap +, then Enter key manually, and enter it as the Setup key. See What is a 2FA setup key?
  6. Type the code from Novaz into the field provided. DigitalOcean's docs call it a PIN.
  7. Choose your backup method (below).

The docs don't say how many digits the codes have, how often they change, or how long the typed key is. Scanning is the safer choice, since the QR code passes those settings to Novaz. If Novaz rejects the typed key, scan instead.

Choose backup codes

Setup also needs a backup method, and DigitalOcean recommends backup codes (DigitalOcean). Its lost-device article lists text messages as the other option (DigitalOcean).

The codes appear on screen, and you can download them as digitalocean_backupcodes.txt. Each works once. You can generate a fresh set when you run low, which cancels all the old ones; the docs don't name that button.

DigitalOcean suggests relying on an authenticator app's backup or sync. Novaz offers a backup: turn on iCloud backup (PRO) or export a backup file. Without one, its keys exist only on your iPhone and that file is your way back in, so keep a copy off the phone, in a password manager or on paper. See 2FA backup codes.

When DigitalOcean asks for a code

Every sign-in with your email and password then asks for a code from the app (DigitalOcean). Turning on 2FA also ends device verification, the code DigitalOcean otherwise emails or texts when you sign in from a new device, place or browser (DigitalOcean).

How often you sign in depends on Session duration on the My Account page: 12 hours by default, adjustable from 1 hour to 30 days, counted from sign-in rather than from your last activity (DigitalOcean).

Teams that require secure sign-in

A team owner can turn on Secure sign-in in the team's Settings. After that, only members who use Google, GitHub or DigitalOcean 2FA can open the team. Others are asked to change their sign-in method first (DigitalOcean).

If DigitalOcean rejects your code

DigitalOcean's help doesn't cover failing authenticator codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?

Changing phones

DigitalOcean's documented way to switch apps is to turn 2FA off, then set it up again (DigitalOcean). Do it before you give up the old iPhone, and save the backup codes the new setup shows. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep your codes working: see How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with your email and password, then on the Two-factor authentication screen (DigitalOcean):

  • click Enter a recovery code and use one from your file (search your computer for its name if you've lost track of it), or
  • if text messages are your backup, click Send an SMS instead, type the code, and click Verify Code.

Once in, set up 2FA on your new phone or turn it off.

If neither works, use the Can't sign in? form, which works without signing in (DigitalOcean). Write from your account's email address and ask for your backup method to be reset. DigitalOcean asks for a photo of a government-issued ID, such as a passport or driver's license, with a name matching the account. It gives no time frame. See also Lost the phone with your authenticator app?

Turning 2FA off

On My Account, in Two-factor authentication, click Disable 2FA (DigitalOcean). A team that requires secure sign-in then stays closed to you until you turn it back on or switch to Google or GitHub.

Official DigitalOcean help

More guides: Hosting and cloud