fortrabbit 2FA: how to set up an authenticator app

fortrabbit is a PHP hosting platform, and your fortrabbit Account is the personal login you use to manage apps, teams and billing in its Dashboard. Two-factor authentication (2FA) is optional but recommended, and there is only one kind: time-based codes from an authenticator app. When fortrabbit launched the feature, it said it had skipped SMS on purpose because text messages can be redirected or intercepted (fortrabbit).

One thing to know first: fortrabbit currently runs two platforms side by side, each with its own Dashboard and its own accounts. The 2FA steps are documented only for the old platform, at dashboard.fortrabbit.com (fortrabbit). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the fortrabbit steps come from fortrabbit's own help pages, documentation and blog, linked below, which we read on October 24, 2026. We haven't tested them on a fortrabbit account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Old platform or new platform?

The new platform, at dash.fortrabbit.com, is in beta and has its own documentation at docs.fortrabbit.com. We searched the full text of those docs and found no mention of two-factor authentication, so we can't tell you whether or where the new Dashboard offers it (fortrabbit).

Accounts weren't copied between the two. fortrabbit plans to move old-platform apps over in batches, with a first wave planned for autumn 2026, and says you'll need to set a new password when your account is moved (fortrabbit). The pages don't say whether 2FA settings carry over, so check your security settings after a migration.

Turn on 2FA with an authenticator app

On the old platform, fortrabbit describes the setting this way (fortrabbit):

1. Sign in at dashboard.fortrabbit.com with your email address and password.
2. Go to Your Account, then 2FA.
3. Follow the guided setup. fortrabbit shows a QR code that holds the secret for your codes (fortrabbit).
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. If you're working on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. Finish the setup in the Dashboard, and save the recovery codes it shows you (more below).

fortrabbit's pages don't say whether the setup screen also offers a text key you can type. If it does, tap +, then Enter key manually in Novaz and paste it into Setup key. See What is a 2FA setup key?

Recovery codes

The guided setup gives you a set of recovery codes. fortrabbit's help says "These codes are always valid for your Account", and they're what you use to sign in if your phone is gone (fortrabbit). Print them or keep them in a password manager, not on the phone that runs Novaz.

This matters with Novaz too: without an iCloud backup or a backup file, its keys exist only on your iPhone, so the recovery codes are your way back in if the phone is gone. See 2FA backup codes.

When fortrabbit asks for a code

With 2FA on, you enter a code from your app when you sign in to the Dashboard. You also need one for critical actions that require SUDO mode, where fortrabbit asks you to confirm your password again (fortrabbit).

The 2015 launch post said there was no "remember this device" option, but that post is marked as possibly outdated (fortrabbit). It also said your Company settings show which team members have turned on 2FA.

If fortrabbit rejects your code

fortrabbit's pages don't give advice for rejected codes. Most often the iPhone's clock has drifted: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Moving to a new iPhone

fortrabbit doesn't describe a phone switch. Its help does say you can disable 2FA from the same place you set it up, so the safe order is: while you still have the old phone, turn 2FA off in Your Account, then set it up again with the new phone and save the new recovery codes. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

• You have your recovery codes: sign in with one, then disable 2FA and set it up again on your new phone (fortrabbit).
• You don't: a password reset won't help, because fortrabbit says the reset doesn't get you in when 2FA is on. Contact fortrabbit and ask them to turn off 2FA by hand (fortrabbit).

To identify you, fortrabbit asks for details only the real owner would know, and says more is better. Its examples include the last two digits of the credit card in use, a previous invoice number or amount, the names of your apps, names and email addresses of team members, and an account of why you lost access. fortrabbit doesn't say how long this takes. More in Lost the phone with your authenticator app?

Official fortrabbit help

• Account (old platform help, dated July 9, 2025)
• The fortrabbit Dashboard (old platform help)
• Introducing 2FA (fortrabbit blog, June 18, 2015)
• Old and new fortrabbit platform compared
• New platform migration program