Skip to content
Novaz AuthenticatorGET

HCP Terraform and Terraform Enterprise 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. First, which login do you use?
  2. Turn on 2FA with an authenticator app
  3. Save the backup codes
  4. Signing in, and organizations that require 2FA
  5. If Terraform rejects your code
  6. If you lose your authenticator
  7. New phone or turning 2FA off
  8. Official HashiCorp help

HCP Terraform at app.terraform.io, and Terraform Enterprise, the version companies run on their own servers, are where teams plan and apply their infrastructure code. HCP Terraform was called Terraform Cloud until April 2024 (HashiCorp). Owners can make two-factor authentication (2FA) mandatory for an organization. HashiCorp documents the same 2FA setting for both products, with small differences (HashiCorp, HashiCorp).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Terraform steps come from HashiCorp's own Terraform documentation, linked below, which we read on October 21, 2026. We haven't tested them on an HCP Terraform or Terraform Enterprise account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, which login do you use?

The setting in this guide belongs to a Terraform account with its own username and password. Not every Terraform user has one:

  • You sign in to HCP Terraform with a HashiCorp Cloud Platform (HCP) account. HashiCorp recommends this, and a linked account manages multi-factor authentication from HCP rather than from the Terraform screens (HashiCorp). Turn it on in your HCP account settings, following HashiCorp's HCP MFA documentation. If HCP linked you through GitHub, use two-factor on your GitHub account instead.
  • Your organization is in HCP Europe. HCP manages MFA there as well (HashiCorp).
  • You have a standalone HCP Terraform account, made on the sign-up page with a username, email address and password, or an account on your company's Terraform Enterprise server. Read on.

Turn on 2FA with an authenticator app

  1. Sign in to HCP Terraform or to your Terraform Enterprise address.
  2. Click your user icon in the top right corner and choose Account Settings.
  3. In the sidebar, click Two Factor Authentication.
  4. On Terraform Enterprise, pick Application. The other choice, SMS Only (Text Message), sends codes by text. A phone number is optional with Application. HashiCorp's HCP Terraform page lists only the app method, so you may not see this choice there.
  5. Click Enable 2FA.
  6. Terraform shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  7. Type the code Novaz shows into Terraform to confirm the setup.

HashiCorp only asks for a "TOTP-compliant application" (HashiCorp). Its docs don't mention a text key you can type instead of scanning, or how many digits the codes have and how often they change. Scan the QR code if you can, because it carries those settings to Novaz. If Terraform does offer a key, you can add it with + and Enter key manually, but a typed key always gets 6-digit, 30-second codes in Novaz. See What is a 2FA setup key?

Save the backup codes

Once 2FA is on, the same page has a Reveal codes button. It shows single-use backup codes, and each one signs you in once (HashiCorp). The docs don't say how many you get or whether you can make new ones.

Without a Novaz backup, its keys are only on your iPhone, so these codes are your way back in if that phone is lost. Keep them somewhere other than the phone. More in 2FA backup codes.

Signing in, and organizations that require 2FA

With 2FA on, you enter a code from your app every time you log in. To use a backup code, click Use a recovery code on that screen (HashiCorp).

Organization owners can make 2FA mandatory under the organization's Settings > Authentication > Require two-factor. Every owner has to turn on 2FA first. On Terraform Enterprise, members of such an organization land on the 2FA setup page when they log in, before they can see anything else (HashiCorp). The organization's Users page shows each member's 2FA status (HashiCorp).

Terraform Enterprise can also require 2FA for site admins: without it, they can log in but can't use admin functions (HashiCorp).

If Terraform rejects your code

HashiCorp's 2FA page has no troubleshooting advice for app codes. Its one technical note is about IPv4: the service that sends 2FA messages doesn't support IPv6 addresses, and SMS can't be used on Terraform Enterprise in an IPv6-only network (HashiCorp).

For app codes, the usual cause is the clock. Check your iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

Start with a backup code: choose Use a recovery code when Terraform asks for your 2FA code.

On Terraform Enterprise, a site admin can switch off your 2FA. On your user page in the admin area, a Disable 2FA button appears next to the admin promotion button. After that, you log in with just your username and password, or reset the password. HashiCorp tells admins to verify the person and the request before they do it (HashiCorp). Admins can also do this through the admin API (HashiCorp). How you prove who you are depends on your company's own rules.

On HCP Terraform, the docs we read describe no reset route for a standalone account without its backup codes. See also Lost the phone with your authenticator app?

New phone or turning 2FA off

HashiCorp doesn't describe moving 2FA to a new phone. The page does have a Disable 2FA button, so while you still have the old phone, you can turn 2FA off, then turn it on again and scan the new QR code on the new phone. If your organization requires 2FA, set it up again right away. If you use Novaz's iCloud backup or a backup file, you can instead restore your accounts on the new iPhone. See How to transfer your authenticator app to a new iPhone.

Afterwards, open the old Terraform entry in Novaz and tap Remove account.

Official HashiCorp help

More guides: Developer tools