HashiCorp Cloud Platform (HCP) 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your HashiCorp Cloud Platform (HCP) account signs you in to the HCP portal, and it can also sign you in to HCP Terraform, HashiCorp's tutorials, the Discuss forums and HashiConf events (HashiCorp). So turning multi-factor authentication (MFA) on or off changes how you get into those sites too, as HashiCorp warns (HashiCorp).
MFA is optional. There's one method, a one-time password (OTP) from an authenticator app, backed by a single recovery code. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the HCP steps come from HashiCorp's own documentation, including the screenshots on its MFA page, linked below, which we read on October 20, 2026. We haven't tested them on an HCP account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Check how you sign in first
HCP accepts three kinds of sign-in, and the MFA setting only exists for one of them (HashiCorp):
- Email and password: this guide is for you.
- GitHub: no HCP MFA. HashiCorp points GitHub users to two-factor authentication on their GitHub account (HashiCorp).
- Single sign-on (SSO) through your company: no HCP MFA either. Ask your company's IT team.
If your HCP Terraform organization turns on Require two-factor, members who sign in with an HCP email account meet it by setting up HCP's MFA (HashiCorp).
Turn on MFA with an authenticator app
- In the HCP portal, open the menu under your profile photo in the top right and choose Account Settings.
- Select the Security tab. Under Multi-factor Authentication (MFA), the Status reads Not enabled.
- Click Enable MFA, then Continue. HCP sends you through its sign-in screen and back, and says setup can take up to 10 minutes.
- A One-Time Password window shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If HCP is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan, click the text code link. HCP copies the key for you rather than showing it. Paste or type it in Novaz: tap +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz in the box and click Verify.
- HCP shows your recovery code. Copy it, tick I have safely recorded this recovery code, and click Finish.
The Status should now read MFA enabled (HashiCorp).
HashiCorp doesn't say how often HCP's codes change, so scan the QR code if you can: it carries the code settings to your app, while a typed key always gets 30 seconds in Novaz.
One recovery code, not a list
HCP's setup screen shows one recovery code, for signing in without your device (HashiCorp). The docs don't say whether you get a new one after using it, or how to view it again.
If the phone is gone and you have no Novaz backup (iCloud backup or a backup file), this code is your main way back in. Store it away from the phone. More in 2FA backup codes.
Signing in afterwards
After your password, a One-Time Password page asks for the 6-digit code. It has a Remember this browser box and a Use the recovery code link (HashiCorp). HashiCorp doesn't say how long a browser stays remembered.
If HCP rejects your code
HashiCorp's troubleshooting note is unusual. When a code won't verify, it says "it's likely that the system is temporarily down" (HashiCorp). Its advice is to try again with a fresh code. It also notes a possible five-minute time-out if you don't complete setup in the time given.
If new codes keep failing, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Moving to a new phone
HashiCorp doesn't describe moving MFA to another phone. It does document turning MFA off and on, so do that while you still have the old phone: disable it with a code from the old phone, then enable it again and scan the new QR code with the new one. With a Novaz iCloud backup or backup file, you can skip that and restore your accounts on the new iPhone. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with your password, choose Use the recovery code on the code page, and enter the code you saved.
With no recovery code and no still-signed-in remembered browser, you can't remove MFA yourself: Support has to do a hard reset (HashiCorp). The Support link on that page now opens IBM Support at ibm.com/mysupport. The docs don't say what proof Support asks for or how long a reset takes. See also Lost the phone with your authenticator app?
Turning MFA off
You need a code, your recovery code, or an active session in a remembered browser. On the Security tab, click Disable MFA, sign in again with a code, and type DISABLE to confirm (HashiCorp). This applies to the other HashiCorp sites too. In Novaz, open the HCP account and tap Remove account.
