Skip to content
Novaz AuthenticatorGET

Gandi 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Keep the recovery codes
  3. When Gandi asks for a code
  4. If Gandi rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official Gandi help

Your Gandi account is the login you use to manage domain names and the other services you buy from Gandi. A second sign-in step is already mandatory there: if you haven't set up anything else, Gandi emails you a 6-digit code each time you sign in (Gandi). Adding an authenticator app, which Gandi calls TOTP, replaces that emailed code with one from your phone. Gandi also supports security keys, and you can use both. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

Mailboxes hosted at Gandi have a separate two-factor setting in its webmail, not covered here (Gandi).

How we checked this guide: the Gandi steps come from Gandi's own documentation and help center, linked below, which we read on October 20, 2026. We haven't tested them on a Gandi account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Gandi gives you recovery codes before it shows the QR code, so have a safe place ready. The steps, from Gandi's documentation (Gandi):

  1. Sign in to your Gandi account on the web.
  2. In the top right corner, click the arrow next to your username, then User Settings.
  3. Click Password & access restrictions. Some Gandi pages call this section Login and Security Options.
  4. Click Enable TOTP. Read the instructions, then click Start.
  5. Save your recovery codes. Gandi lets you print the page, download the codes or copy them. Then click Continue.
  6. Gandi shows a QR code, which its help calls a barcode. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot, then tap + and Choose a photo. See scanning a QR code on the same iPhone.
  7. If you can't scan it, use the unnamed key Gandi shows in a black box. In Novaz, tap +, then Enter key manually, type Gandi as the Service, and enter the key as the Setup key. See What is a 2FA setup key?
  8. Click Continue. Gandi then asks for the current code from Novaz and your Gandi password. Click Continue once more to finish.

Gandi's codes have 6 digits and change every 30 seconds (Gandi), which matches Novaz's settings for a typed key. Gandi doesn't give the key's length, and Novaz needs at least 16 characters, so scanning is safer.

Keep the recovery codes

Each recovery code works in place of an app code when you sign in. Once you're in with one, Gandi says you can turn TOTP off or link a new authenticator app (Gandi).

With Novaz, these codes are your way back in if the phone is gone and you have no iCloud backup or backup file: without one, its keys stay only on that iPhone. Keep them in a password manager or on paper, away from the phone. If you turned on TOTP before Gandi offered recovery codes, support is your only documented way back. More in 2FA backup codes.

When Gandi asks for a code

With TOTP on, Gandi asks for a code from your app every time you sign in, and the emailed code is no longer needed (Gandi). If you also add a security key, Gandi asks for the key first and falls back to the app code when you don't have the key with you. Either one gets you in, and Gandi recommends keeping both so that a broken key doesn't lock you out (Gandi).

If Gandi rejects your code

Gandi's own tip: the code depends on the clock, so a difference in time or time zone can cause an error (Gandi). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Gandi doesn't describe a phone switch as such, but you can use Disable TOTP (below) and then Enable TOTP again with the new phone, while you still have the old one. In between, Gandi goes back to emailing you a code at sign-in (Gandi). With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead; without one, you add Gandi to the new phone from scratch. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Start with a recovery code, typed where Gandi asks for the TOTP code.

Gandi's account recovery options (email, text message, QR code, security key) won't help: they reset a forgotten username or password but don't remove TOTP (Gandi).

Without recovery codes, you need Gandi support to remove TOTP. Open a ticket through the Gandi help center and send the signed form attached to Gandi's article on lost devices (Gandi). The form, titled Authentication Factor Deactivation Request, asks for (Gandi):

  • your Gandi username, name and email address, matching the account;
  • clear photos of the front and back of a government-issued photo ID;
  • two selfies of you holding the completed form and the ID, one showing each side of the ID;
  • for an account owned by a company or other organization, a document showing you can act for it.

Gandi prefers email to post, may contact you by email or phone, and may ask for more proof. It doesn't say how long this takes. More in Lost the phone with your authenticator app?

Turning 2FA off

Go to User Settings, then Change password & configure access restrictions (the activation steps call it Password & access restrictions), click Disable TOTP, and confirm with your password (Gandi). Sign-ins then return to the emailed code. In Novaz, open the Gandi account and tap Remove account.

Official Gandi help

More guides: Domain registrars