FogBugz 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
FogBugz is IgniteTech's bug tracker and project management tool for software teams, and its sign-in also covers Kiln, the companion code-hosting service. Two-factor authentication (2FA) in FogBugz works only with an authenticator app. There's no text-message option. It's also a choice each person makes for their own account: FogBugz says an administrator can't make it mandatory or switch it on for other users (FogBugz). If your team wants everyone on 2FA, each person has to set it up themselves.
This guide uses Authenticator App - Novaz on iPhone. Any time-based authenticator app works the same way.
How we checked this guide: the FogBugz steps come from FogBugz's own support articles, linked below, which we read on October 21, 2026. We haven't tested them on a FogBugz account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you turn it on
Turning on 2FA changes more than the sign-in screen. FogBugz lists these effects (FogBugz):
- Every other session and token you have stops working. Only the session you used to turn on 2FA stays signed in.
- Scripts that sign in through the FogBugz API's login command break. You'll need an API token instead (FogBugz).
- If you use Kiln, you have to reach your repositories over SSH.
- The Kiln Client's path-guessing feature is turned off.
Turn on 2FA with an authenticator app
FogBugz's support article describes these steps (FogBugz):
- Sign in to your FogBugz site and open the avatar menu, then User Options.
- Click Enable Two-Factor authentication.
- FogBugz shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan it, FogBugz lets you enter the details by hand. The article doesn't name the key or say how to show it. In Novaz, tap +, then Enter key manually, and enter the key as the Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz on the 2FA configuration page and click Verify Code.
- The next page shows your backup codes. Save them before you leave it.
Your backup codes
Each backup code works once. If you use some up, you can make a new set, which the article says is on the User Accounts page. That's a different name from User Options, so look on your settings page if you don't find it (FogBugz).
FogBugz warns against protecting the codes with the same password you use for FogBugz. So if you keep them in a password manager or an encrypted file, make sure it doesn't open with your FogBugz password. Paper in a safe place works too.
Unless you turn on iCloud backup or export a backup file in Novaz, its keys exist only on your iPhone, so these codes are your way back in if that phone is gone. More in 2FA backup codes.
When FogBugz asks for a code
FogBugz asks for a code each time you sign in to FogBugz or Kiln. You can type a code from your app or one of your backup codes (FogBugz). The article doesn't mention a way to remember a trusted device.
If FogBugz rejects your code
FogBugz's own fix for iPhone users is to resync the clock: open Settings > General > Date & Time, turn Set Automatically off for a few seconds, then back on (FogBugz). Novaz also warns you when the iPhone's clock is 15 seconds or more off. If the clock is right and the code still fails, see Authenticator code not working?
If you lose your authenticator
Sign in with one of your backup codes. That also covers a deleted app or codes that won't work.
Without backup codes, the route is your own team, not FogBugz support: a Site Admin on your FogBugz account has to turn off 2FA for you (FogBugz). Once it's off, sign in and set it up again. See Lost the phone with your authenticator app?
If you're the only admin and you're locked out, the articles don't say what to do on FogBugz On-Demand. For FogBugz on your own server, there's a database route (below).
For admins: turning 2FA off for a user
On FogBugz On-Demand, go to your site at [subdomain].fogbugz.com, open the avatar menu, then Users. Pick the user, choose Edit, and click the link that turns off 2FA (FogBugz).
On an on-premises install, an admin can also clear 2FA in the FogBugz database for one user, several users or everyone. FogBugz's article gives the SQL for each case.
FogBugz doesn't describe a way for users to turn off their own 2FA from User Options.
Changing phones
FogBugz doesn't describe moving 2FA to a new phone. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your FogBugz codes keep working. Without one, plan on asking a Site Admin to turn off 2FA for you, then setting it up again on the new phone from User Options. Keep your backup codes until you're done. See How to transfer your authenticator app to a new iPhone.
