Doppler 2FA: how to set up an authenticator app

Doppler holds your team's secrets: API keys, database passwords and the environment variables your apps load at runtime. One thing matters more than the setup steps here. Doppler says it can't reset multi-factor authentication (MFA) on an account, so if you lose every way to pass the second step, you lose the account and have to start over with a different email address (Doppler). Set up a backup before you need it.

Every Doppler account already gets a code by email at sign-in. On top of that, you can add a one-time password (OTP) from an authenticator app, or security keys such as a YubiKey, Touch ID or Face ID (Doppler). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Doppler steps come from Doppler's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a Doppler account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Signed in with Google, GitHub or SAML SSO?

Then you won't see the MFA section in your Doppler account settings. Doppler turns its own MFA off for these sign-ins and leaves the second step to the identity provider, so turn on 2FA there instead (Doppler). The steps below are for accounts that sign in with an email address and password, which is the group Doppler's security fact sheet encourages to turn on MFA (Doppler).

Turn on 2FA with an authenticator app

Doppler's MFA page describes this route (Doppler):

1. Sign in to the Doppler dashboard. Open the Avatar menu in the top right corner and choose Account.
2. Scroll down to the Multi-Factor Authentication section. (Doppler's screenshot titles it Multifactor Authentication (MFA), so the label may vary.)
3. Click Configure next to One-Time Password.
4. Doppler shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Finish the setup by entering the code Novaz shows for Doppler.
6. Generate your Recovery Codes when Doppler prompts you, and store them somewhere safe.

Doppler's page calls this a typical OTP setup and doesn't say whether it also shows a key you can type. If it does and you can't scan, tap + in Novaz, then Enter key manually, and put the key in Setup key. See What is a 2FA setup key?

Once OTP is on, Doppler asks for the app code at sign-in in place of the emailed code (Doppler).

Recovery codes are your safety net

Doppler offers recovery codes only after you turn on OTP, and it treats them as essential because its support can't step in later (Doppler). Don't skip this step. Without a Novaz backup (iCloud backup or a backup file), the keys exist only on your iPhone, and the recovery codes are your way back in. Keep them in a password manager or on paper, away from the phone. More in 2FA backup codes.

Doppler also suggests setting up more than one MFA method where you can. For security keys, it recommends registering at least two.

If Doppler rejects your code

Doppler's documentation doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

Doppler lists two ways back in (Doppler):

• A recovery code. Use one to sign in, then turn off OTP and set it up again on your new device.
• The Doppler CLI. If a computer is still signed in to the Doppler CLI, running doppler mfa recovery there gives you a recovery code that works once.

A registered security key also gets you past the second step. If none of these work, Doppler's page says the account can't be recovered. There's no support form or identity check to fall back on. See Lost the phone with your authenticator app? for general advice.

Moving to a new iPhone

If you have a Novaz iCloud backup or backup file, restore your accounts on the new iPhone and Doppler keeps working. Without one, you'll add Doppler again on the new phone. Doppler's documented path is to sign in, turn off OTP, and configure it again on the new device. Its page doesn't spell out the screens for turning OTP off. Do this while the old phone still works, and keep a recovery code at hand in case. See How to transfer your authenticator app to a new iPhone.

Official Doppler help

• Multi-Factor Authentication (MFA)
• Security Fact Sheet
• CLI Guide