Drupal.org 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Drupal.org account is the one you use for issue queues, contributed projects and related sites such as git.drupalcode.org. You won't find two-factor controls on your profile itself. Since August 2024, your password and two-factor authentication (2FA) live in a separate account console at accounts.drupal.org, a Keycloak sign-in service hosted by Cloud-IAM (Drupal.org). The only second factor Drupal.org documents is an authenticator app that makes time-based (TOTP) codes (Drupal.org). It's optional for most people, though in 2015 Drupal.org required it for users with advanced access (Drupal.org), and its current pages don't restate that rule. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Drupal.org steps come from Drupal.org's own documentation and blog posts, including the screenshots in its announcement of the new sign-in, linked below, which we read on October 20, 2026. We haven't tested them on a Drupal.org account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- You may need the Confirmed user role. Drupal.org's roles page, last updated in April 2025, lists two-factor authentication among the things a Confirmed user can do (Drupal.org). The 2024 sign-in announcement doesn't mention that limit. If you can't find the option, see how to become a confirmed user.
- Old entries in your app no longer work. When Drupal.org moved to the new sign-in on August 8, 2024, everyone who already had 2FA had to set up a new seed (Drupal.org). An older Drupal.org entry in your app is out of date.
Turn on 2FA with an authenticator app
Drupal.org's docs page, marked as needing work, stops at the account console link. The rest comes from screenshots in the July 2024 announcement (Drupal.org, Drupal.org).
- Sign in to Drupal.org (you're sent to accounts.drupal.org and back).
- Go to www.drupal.org/user-edit. That's the Edit tab of your profile, on its Account sub-tab.
- Under your email address, click the link to your account console. It mentions two-factor authentication; the 2024 screenshot and the 2025 docs page word it slightly differently.
- In the account console's sidebar, choose Account security and follow it to the two-factor setup. Drupal.org doesn't show the screens in between.
- The Mobile Authenticator Setup page suggests FreeOTP, Google Authenticator and Microsoft Authenticator, but any TOTP app will do. In Novaz, tap +, then Scan QR code, and point the camera at the barcode. If it's on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, there's an Unable to scan? link under the barcode. Drupal.org doesn't show what it reveals. If it's a text key, tap + in Novaz, then Enter key manually, and paste it into Setup key. Drupal.org doesn't document its code length or interval, so scanning is safer: the QR code carries those settings. See What is a 2FA setup key?
- Type the current code from Novaz into One-time code.
- Optionally, fill in Device Name, such as "iPhone", so you can tell your OTP devices apart later.
- Sign out from other devices is ticked in the screenshot; leave it on to close other sessions. Click Submit.
Signing in afterwards
After your username or email and password, accounts.drupal.org asks for a One-time code. Type the code from Novaz and click Sign In. Drupal.org doesn't say what the Try Another Way link offers (Drupal.org).
Git from the command line doesn't use these codes. Pushing to Drupal.org projects works with SSH keys or a personal access token (Drupal.org).
No documented backup codes
Drupal.org's current pages don't mention backup or recovery codes. If Account security offers some, save them away from your phone. Otherwise your key lives only in Novaz on that iPhone, unless you've made a Novaz backup with iCloud backup or a backup file. Keep access to the email address on your account: it's where Drupal.org sends password resets (Drupal.org).
If Drupal.org rejects your code
Drupal.org gives no advice here. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also check that you're not using a Drupal.org entry from before August 2024. More causes are in Authenticator code not working?
Changing phones
Drupal.org doesn't document replacing your authenticator. Do it from Account security while you can still sign in with the old phone. Unless you restore your Novaz accounts on the new iPhone from iCloud backup or a backup file, you'll scan a new QR code on the new phone. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
The documented route is support: the sign-in announcement says to email help@drupal.org with any problem with your account (Drupal.org). Drupal.org doesn't say what proof it asks for or how long a reset takes. Writing from your account's email address and including your username should help. More in Lost the phone with your authenticator app?
Drupal.org also doesn't document how to turn 2FA off.
