Figma 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Figma account is the one you use for Figma Design, FigJam and Figma's other apps. Before you look for the two-factor authentication (2FA) setting, check how you log in. Figma's own 2FA only covers accounts that sign in with an email address and password. If you use Continue with Google or your company's SAML SSO, you can't turn it on in Figma; you set it up with your identity provider instead (Figma).
For email-and-password accounts, on any plan, Figma offers text messages or an authenticator app. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Figma steps come from Figma's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a Figma account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
When Figma requires it
- Publishing plugins and widgets: you need 2FA before you publish or update a classic plugin, or publish a widget to the Figma Community (Figma, Figma). The widgets page says accounts that use Google or SAML SSO don't need it.
- Guests of some Enterprise organizations: with the Governance+ add-on, an admin can block guests without 2FA from the organization's files until they turn it on (Figma).
- Everyone else: it's optional, but Figma recommends it (Figma).
Turn on 2FA with an authenticator app
Figma asks you to pick the method at the start, so install Novaz first (Figma):
- In the file browser, click your name in the top-left corner and select Settings.
- On the Security tab, click Enable two-factor authentication.
- Enter your Figma password and click Continue.
- Figma shows links for downloading authenticator apps. Click Continue.
- Figma shows a barcode. In Novaz, tap +, then Scan QR code, and point the camera at it. If Figma is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz and click Verify.
- Click Continue to recovery codes and save the list Figma shows.
Figma's help doesn't mention a text key to type instead of scanning, or how often the codes change, so scan the barcode: it tells Novaz the code settings. If you do find a key, use Enter key manually and see What is a 2FA setup key?
If you also use text messages
If you set up SMS first, you can add an authenticator app to it. With both on, Figma asks for the app code first, and Send me an SMS switches to a text. Figma's SMS codes have seven digits and Novaz shows six, so you can tell them apart (Figma).
Keep your recovery codes
Figma suggests a password manager or encrypted storage for the recovery codes. Its help doesn't say how many you get, how to use one at sign-in, or whether you can make new ones. Without a Novaz iCloud backup or backup file, its keys exist only on your iPhone, so these codes are your way back in if the phone is gone. See 2FA backup codes.
When Figma asks for a code
With 2FA on, Figma asks you to confirm your identity every time you log in (Figma). Its help doesn't mention remembering a trusted device.
Figma says it will never ask for your 2FA codes by email, text or any other insecure channel (Figma).
If Figma rejects your code
Figma's help doesn't cover rejected codes. Make sure you're reading the Figma entry in Novaz, then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones
Figma doesn't describe moving 2FA to a new phone. It does say you can remove or reconfigure 2FA at any time (Figma), so turn the authenticator app off while you can still sign in, then set it up again on the new phone. If you back up Novaz with iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Use a recovery code. If you also set up SMS, choose Send me an SMS.
Without either, there's no Figma help page for a lost authenticator. Its general route when you can't get into your account is a request through the Support Hub that includes your account's email address. Paid plans get email support on weekdays; Starter and Education requests move to Figma's forum (Figma). Figma doesn't say what proof it asks for or how long it takes. More in Lost the phone with your authenticator app?
Turning 2FA off
The off switch is on a different tab from the setup (Figma):
- In Settings, open the Account tab and scroll to Password.
- Next to Authenticator apps are enabled, click Disable.
- Enter your password, click Continue, then Ok.
If the setting isn't under Account, check Security. Then open Figma in Novaz and tap Remove account. Plugin and widget authors need 2FA on again before their next release.
