Skip to content
Novaz AuthenticatorGET

Expensify 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Find your recovery codes
  3. Signing in with 2FA on
  4. If Expensify rejects your code
  5. If you lose your authenticator
  6. Changing phones
  7. Official Expensify help

Many companies use Expensify for receipts, expense reports and reimbursements. It doesn't use passwords at all: you sign in with a security code that Expensify emails you each time (Expensify). Two-factor authentication (2FA) adds a second code on top of that one, and the only kind Expensify documents is a time-based code from an authenticator app (Expensify). Anyone can turn it on for their own account, and a company's Domain Admin can make it mandatory for everyone on the company's email domain.

The steps below use Authenticator App - Novaz on iPhone. Any authenticator app works the same way, and Expensify says you can use whichever one you like.

How we checked this guide: the Expensify steps come from Expensify's own help pages, linked below, which we read on October 21, 2026. We haven't tested them on an Expensify account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Expensify currently has two versions, New Expensify and Expensify Classic, and the setting sits in a different place in each. The rest of the setup is the same.

  1. Open the security settings:
    • New Expensify: in the left-hand menu, choose Account > Security, then Two-Factor Authentication (Expensify).
    • Expensify Classic: go to Settings > Account > Profile (Expensify).
  2. Turn on Two-factor authentication.
  3. Expensify saves your recovery codes to the device you're using as soon as you do this. Copy them somewhere safe as well, then click Continue.
  4. Expensify shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're setting this up in the Expensify app on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  5. Type the 6-digit code from Novaz into Expensify and click Verify.

Expensify's help only describes scanning the QR code. It doesn't mention a text key you can type instead. If your screen shows one, in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?

Find your recovery codes

You don't get a choice about downloading the codes: Expensify does it for you. For setups after May 2026, the file goes into the device's Downloads folder, named DO-NOT-DELETE_Expensify-2FA-RecoveryCodes. Each code works in place of an authenticator code (Expensify). Older setups may have a file called two-factor-auth-codes instead, which is the name Expensify's login troubleshooting page tells you to search for (Expensify).

Keep them even if you back up Novaz with iCloud backup or Export to file…: they get you in if the phone is lost and the backup is missing or out of date. Move the file to a password manager or print it. Expensify also suggests adding 2FA to more than one device, such as a phone and a tablet. If you want that, scan the same QR code with the second device's authenticator app before you click Verify. More in 2FA backup codes.

Signing in with 2FA on

Expensify asks for both codes every time you sign in: first the security code from your email, then the 6-digit code from your authenticator app (Expensify).

If you're asked for an authenticator code you don't remember setting up, your Domain Admin may have required 2FA for your company. Look on your phone for an authenticator app and search your files for the recovery codes.

If Expensify rejects your code

Expensify's own advice is to make sure your device's clock updates automatically, because even a small difference can make codes fail (Expensify). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

If the rejected code is the emailed one, use the newest email: asking for a new security code cancels the earlier ones. Other causes are in Authenticator code not working?

If you lose your authenticator

What happens depends on the email address you sign in with (Expensify):

  • You have your recovery codes: type one of them in place of the authenticator code when you sign in.
  • Work email on a company domain: ask your Domain Admin to reset your 2FA. The admin needs 2FA on their own account, and the reset is only in Expensify Classic, under Settings > Domains > Domain Members > Edit Settings > Reset. You can then sign in and set it up again.
  • Work email, but no Domain Admin: Expensify says you can claim the company domain yourself and reset your own 2FA from there.
  • Personal email, such as Gmail: Expensify can't reset 2FA for you. Without your recovery codes, it says you'll need to create a new account.

Reinstalling the authenticator app won't bring the keys back, unless you restore them from a Novaz backup. More in Lost the phone with your authenticator app?

Changing phones

Expensify's help doesn't describe moving 2FA to a new phone or turning it off from your own settings. With a Novaz iCloud backup or backup file, you restore your accounts on the new iPhone and the Expensify codes keep working. Without one, a new phone means adding Expensify to Novaz again. Keep the old phone and your recovery codes until the new phone gives codes Expensify accepts. See How to transfer your authenticator app to a new iPhone.

Official Expensify help

More guides: Payments, accounting and insurance