EXMO 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
EXMO is a cryptocurrency exchange, and two-factor authentication (2FA) there protects both your sign-in and your withdrawals. The list of methods got shorter in 2025. Since July 16, 2025, EXMO no longer accepts SMS codes or push codes from its own app, and accounts still on those methods have their access restricted. What's left is a time-based authenticator app or a passkey (EXMO).
EXMO's pages only name Google Authenticator. It's a standard time-based (TOTP) setup with a QR code and a key, so other authenticator apps should work the same way. This guide uses Authenticator App - Novaz on iPhone.
How we checked this guide: the EXMO steps come from EXMO's own Info Hub and news posts, linked below, which we read on October 22, 2026. Several of those pages no longer open on exmo.com: some return "Page not found" and the setup articles redirect to an image, so we read them in archived copies on web.archive.org. We haven't tested the steps on an EXMO account, and the most detailed setup article dates from 2019, so labels may differ. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
EXMO's 2025 notice gives a short path for each version (EXMO):
- Website: go to your profile, open Settings, then the Security tab, and select Google Authenticator.
- EXMO app: go to your Profile, open More, then the Security tab, and tap Google Authenticator. EXMO added this to its iOS and Android app in June 2025 (EXMO).
On the website you can scan the screen with your iPhone. The older step-by-step article describes the rest (EXMO):
- Select Generate a new key. EXMO shows a QR code and a 16-character key in the Secret key section.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If you're on the EXMO app on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan, type the key: tap +, then Enter key manually, enter EXMO as the Service, and paste or type the key as the Setup key. The same article says authenticator codes change every 30 seconds, which matches what Novaz uses for a typed key. See What is a 2FA setup key?
- Choose how much the code protects (next section).
- Type the 6-digit code from Novaz and select Save Settings.
Choose the protection level
EXMO lets you decide where the code is asked for. Its current FAQ calls the options Account sign-in and Account sign-in and fund withdrawal (EXMO). The 2019 article used the names Use only for authorization and Full protection for the same choice.
- Account sign-in: a code each time you sign in, along with your email and password.
- Account sign-in and fund withdrawal: a code at sign-in, for every withdrawal, and when you change your profile settings.
With the second option there's also a box, Allow skipping 2FA when withdrawing funds to wallets from "Templates". Tick it and withdrawals to addresses you've saved as templates no longer ask for a code. A withdrawal to new details still does.
No backup codes
None of EXMO's pages mention backup or recovery codes, and they don't describe a second authenticator or any other fallback. Novaz can keep a copy of its keys with iCloud backup or Export to file… (Settings > Backup). On EXMO's side, the other method is a passkey, using Face ID, a fingerprint, iCloud Keychain or a security key (EXMO). EXMO's pages don't say whether you can have a passkey and an authenticator app on at the same time.
If EXMO rejects your code
EXMO has an error for this: 10419, "TOTP Code is not true". Its explanation is a clock difference between your phone and your computer (EXMO). EXMO's fix is written for Google Authenticator's time-sync setting, which Novaz doesn't have. On an iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
EXMO doesn't describe moving the authenticator to a new phone. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your EXMO codes keep working. Without one, the safe order is to keep the old phone working, turn 2FA off in EXMO's Security section, then set it up again with the new phone. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
EXMO's pages don't explain how to get in without your authenticator app. The only route they point to is EXMO Support, which the Info Hub says is available 24/7 through a ticket form at support.exmo.com (EXMO). For a lost passkey, EXMO says outright that Support can recover the account (EXMO).
EXMO doesn't say what proof it asks for after a lost authenticator, or how long it takes. For a hacked account, it asks you to include the reason, your EXMO username and the email address on the account (EXMO), so have those ready. More in Lost the phone with your authenticator app?
Turning 2FA off
In the Security section of your profile settings, turn 2FA off with the slider (EXMO). Keep in mind that since July 2025 EXMO restricts accounts without a supported method, so add a passkey or set up the app again soon after.
Official EXMO help
- Two-factor authentication (2FA)
- Important: SMS and Push 2FA will no longer be supported (archived copy)
- 2FA Google Authenticator hits the EXMO app (archived copy)
- How to enable two-factor authentication (2FA)? (archived copy)
- How to set up Google Authenticator? (archived copy)
- Passkeys: the new standard in secure and hassle-free authentication (archived copy)
- What is error 10419: "TOTP Code is not true"?
- General security questions
