Harness 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Harness is a software delivery platform: teams sign in at app.harness.io to run pipelines, manage deployments and work with modules such as Feature Management & Experimentation (FME). Its two-factor authentication (2FA) has one method, a time-based code from an authenticator app on your phone, asked for after your password (Harness). You can turn it on for your own user, and an account administrator can make it mandatory for everyone in the account.
If you came to Harness from Split, this is the setting you use too. Migrated Split accounts open FME through the Harness platform, and authentication such as 2FA is configured at the platform level, not inside FME (Harness).
This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Harness steps come from Harness's own developer documentation, linked below, which we read on October 24, 2026. We haven't tested them on a Harness account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
The setting lives in your user profile, not in account settings (Harness):
- Select your User Profile icon in the bottom-left corner of Harness.
- On your profile page, switch on Two-Factor Authentication. A dialog called Enable Two-Factor Authentication opens with a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at it. If Harness is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Can't scan? The same dialog shows a Secret Key. In Novaz, tap +, then Enter key manually, type a name such as Harness under Service, and paste the key into Setup key. See What is a 2FA setup key?
- Select Enable.
Harness says the entry in your app shows up as Harness-Inc. Its documentation doesn't ask you to type a code before you select Enable, and it doesn't give the code length or how often codes change. Scanning the QR code is the safest route, because the code settings travel with it. A key typed by hand in Novaz always makes 6-digit codes every 30 seconds. After you add it, tap the account in Novaz and check Interval under Details.
From your next sign-in on, Harness asks for the code from your app after your password.
Save the Secret Key, because there are no backup codes
Harness's 2FA page doesn't mention backup or recovery codes. Its only documented way back in, if your phone is gone, is an administrator resetting your 2FA (below). For admins who set up 2FA before enforcing it, Harness suggests keeping the QR code and secret key for account recovery (Harness).
That advice holds with Novaz too: its keys stay on your iPhone unless you turn on iCloud backup or export a backup file, and a backup can be out of date. Before you select Enable, copy the Secret Key into a password manager or onto paper you keep somewhere safe. Anyone who has it can make your codes, so guard it like a password. See 2FA backup codes for how to store recovery details.
When your administrator enforces 2FA
Account administrators, or users with Create/Edit permission on Authentication Settings, can switch on Enforce Two Factor Authentication under Account Settings > Authentication. Harness makes them protect their own login first (Harness). Once it's on:
- new members set up 2FA as part of signing up;
- existing members who haven't turned it on get an email with a QR code and setup steps. Scan that QR code with Novaz the same way as above.
Harness checks both settings at sign-in and asks for a code if either is on. So with enforcement on, you get the prompt even if your own profile toggle is off. Harness also says the enforced setting covers every login, through SSO providers as well as Harness usernames and passwords (Harness).
If you belong to more than one Harness account, switching between them can ask you to sign in again when the other account uses a different authentication setup, 2FA included (Harness).
If Harness rejects your code
Harness's documentation doesn't give user-facing advice on rejected codes. Its audit trail lists the reasons a 2FA login can fail, including a one-time password that is "incorrect or has expired" (Harness). An expired code usually means the phone's clock is off. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
If you lose your authenticator
Ask an administrator of your Harness account. Under Account Settings > Access Control > Users, they open More Options (⋮) next to your name and choose Email new Two Factor Auth secret. You then get an email with a new QR code and secret key to set up your app again (Harness). Delete the old Harness entry from your app so you don't mix up the two.
Harness's documentation doesn't say what happens when the only administrator loses their own authenticator, or what proof anyone has to give. If you saved the Secret Key, you can add it to a new app yourself. See Lost the phone with your authenticator app?
Changing phones
Harness doesn't document a way to move 2FA to a new phone. With a Novaz iCloud backup or backup file, you restore your accounts on the new iPhone. Without one, you add Harness again: from the Secret Key you saved, or from the new QR code an administrator emails you. Keep the old phone until you've signed in with the new one. See How to transfer your authenticator app to a new iPhone.
Turning 2FA off
Harness says you can switch your own user-level setting on or off from your profile (Harness). If your account enforces 2FA, you'll still be asked for a code. Only an administrator can turn enforcement off.
