Expo 2FA: how to set up an authenticator app for your Expo account
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Expo account is the one you sign in with on expo.dev, in the Expo Go app, and in the Expo and EAS command-line tools. With two-factor authentication (2FA) on, all three ask for a short-lived code after your password (Expo). An authenticator app is the only method you can add today; existing text-message setups still work, but Expo accepts no new ones. 2FA is optional unless an organization you belong to requires it. This guide uses Authenticator App - Novaz on iPhone, but any app that makes time-based (TOTP) codes works the same way.
How we checked this guide: the Expo steps come from Expo's own documentation, changelog and Security & compliance page, linked below, which we read on October 20, 2026. We haven't tested them on an Expo account, and Expo's docs don't name every button, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start: support can't switch it off for you
Expo's 2FA page says you may email support, but that it can't guarantee getting you back in (Expo). Its Security & compliance page goes further: "Expo staff are unable to bypass the additional login factors" once the device and codes are lost (Expo). Decide where your recovery codes will live before you scan anything.
Turn on 2FA with an authenticator app
Expo's documentation describes the setup in outline rather than button by button (Expo):
- Sign in at expo.dev and open your personal account settings (expo.dev/settings), which have a two-factor authentication section.
- Start the setup for an authenticator app.
- Expo shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot, tap + and pick Choose a photo (scanning a QR code on the same iPhone).
- Type the code Novaz shows into Expo to confirm. That finishes the setup.
- Save the recovery codes Expo gives you. If you choose to download them, they come as a file named expo-recovery-codes.txt.
Expo's page mentions only the QR code, not a text key, the code length or the interval, so scan it: the QR code carries those settings to Novaz. If you're shown a key, tap +, then Enter key manually, and type it as the Setup key (What is a 2FA setup key?); Novaz then makes 6-digit, 30-second codes.
Recovery codes are your backup
Each recovery code works once, in place of a code from your app. You can make a new set in your personal account settings, and doing so cancels every old code (Expo). If your iPhone is gone and you have no Novaz backup, or one made before you added Expo, these codes are your way in. Store them away from it, in a password manager or on paper. See 2FA backup codes.
Expo also suggests a second method on a different device (Expo), but with new text-message setups closed, its docs don't say what that second method could be.
When Expo asks for a code
- Signing in with your password, on expo.dev, in Expo Go, or in the Expo or EAS CLI (Expo). Both CLIs send you to your browser to sign in by default, so that's where you type it (Expo, Expo).
- Changing your 2FA settings, including adding or removing a method (Expo).
- Not with a passkey. Since July 2026 you can add a passkey to your account, and it signs you in without the second step even when 2FA is on (Expo).
The docs don't mention remembered devices. For CI, an access token in EXPO_TOKEN lets EAS CLI run without eas login (Expo).
If Expo rejects your code
Expo's help doesn't cover rejected codes. The usual culprit is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?
Organizations that require 2FA
On Production and Enterprise plans, owners and admins can make 2FA mandatory; the announcement's screenshot shows a Require button under Team settings > Security > Two-factor authentication (Expo). After that, you can't accept an invitation to the organization without 2FA, and members who have it can't turn it off. Members who sign in through the organization's SSO aren't covered.
Changing phones
Expo doesn't describe a phone switch. Its settings let you add and remove methods, each change needing a one-time password (Expo). So do it while the old phone still shows codes: set up Novaz on the new phone there, then remove the old method. With a Novaz iCloud backup or backup file, you can instead restore the entry on the new iPhone and change nothing on Expo's side; see How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- Sign in with a recovery code where Expo asks for the one-time password (Expo). Then replace the lost method in your settings. Changes there need a one-time password, and the docs don't say whether a recovery code is accepted for that.
- If you still have another method, such as an older text-message one, use that.
- With neither, Expo's docs say to email support from the address on your account (Expo). If you can't log in to its contact page, the Support options page has a form for sign-in trouble (Expo). Expo doesn't say what proof it wants or how long this takes, and, as its Security & compliance page warns, it may not be able to help.
More in Lost the phone with your authenticator app?
Turning 2FA off
You can disable it in your personal account settings, with a one-time password (Expo), unless an organization you're in requires it. Then open the Expo entry in Novaz and tap Remove account.
