Heap 2FA: how to set up an authenticator app

Heap is the product analytics tool, now part of Contentsquare, that your team signs in to for charts, funnels and session replays (Heap). Its two-factor authentication (2FA) works with an authenticator app, and it asks for a code on top of your password, or on top of your single sign-on if your company uses SSO (Heap). Heap's help doesn't mention text-message or email codes.

Two things set Heap apart. You get exactly one recovery code, and Heap shows it only once. And an admin can make 2FA mandatory for everyone, or reset it for a teammate who is locked out. This guide uses Authenticator App - Novaz on iPhone for the app steps, but any authenticator app works the same way.

How we checked this guide: the Heap steps come from Heap's own help center, linked below, which we read on October 21, 2026. Heap's article pages block automated visits, so we read the article text through the help center's public article feed on help.heap.io and checked it against an archived copy on web.archive.org from October 7, 2025, which matches. We also looked at the screenshots in the article. We haven't tested the steps on a Heap account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Every Heap user can do this for their own account (Heap):

1. In Heap, go to Account > Manage > Personal settings. This page also holds your password and time zone (Heap).
2. Click Enable Two-Factor Authentication.
3. Under Two-factor authentication, Heap shows a barcode (a QR code). In Novaz, tap +, then Scan QR code, and point the camera at it. If Heap is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. Type the six-digit code from Novaz into the boxes and click Confirm Code.
5. A Recovery Code window opens. Copy the code somewhere safe, or click Download to save it as a file.

Heap's article and its screenshots show only the barcode. They don't mention a text key you could type by hand, so plan to scan.

Your one recovery code

The recovery code is your only fallback. Heap says you won't see it again after that window closes. The window itself says the code can get you into your account "if you lose access to your two-factor device" (Heap). Heap's article adds that the code is needed to turn off 2FA if you lose your device.

With Novaz, that code matters unless you've backed up with iCloud backup or a backup file, because otherwise its keys are only on your iPhone. Store the code away from your phone, for example in a password manager or on paper. Heap's help doesn't say whether the code stops working after one use or how to get a new one. More on storing codes in 2FA backup codes.

When admins make 2FA mandatory

Admins can require 2FA for all admins or for every user in the Heap account. The setting is the Mandatory Two-Factor Authentication drop-down under Account > Manage > Account settings, and it applies to the whole organization as soon as it's picked (Heap, Heap). Heap suggests reminding people to save their recovery codes before you switch it on. Its help doesn't describe what a user without 2FA sees at the next sign-in once it's required.

If Heap rejects your code

Heap's help doesn't cover rejected codes. The most common cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

You have two routes:

• Your recovery code. Use it to get back in, as the recovery window describes. Heap's help doesn't show the exact screen where you enter it.
• An admin on your team. Admins can reset 2FA for anyone: Account > Manage > Teammates, click the person, then Reset Two-factor Authentication in the sidebar (Heap). Only admins can do this, so a regular user needs to reach one by some other channel.

Heap's help doesn't describe a route for an admin who loses both the authenticator and the recovery code, and doesn't say whether Heap support can reset 2FA. If you're the only admin, consider adding a second one. See also Lost the phone with your authenticator app?

Changing phones or turning 2FA off

Heap's help doesn't describe moving 2FA to a new phone. Its article has a section on removing and reconfiguring 2FA, but it points to the Mandatory Two-Factor Authentication drop-down, which is the organization-wide setting rather than a switch for your own account (Heap). Your Personal settings page is where Heap says you manage your own 2FA, so look there first. If that doesn't help, ask an admin to reset your 2FA while you still have the old phone, then turn it on again with the new one. With a Novaz iCloud backup or backup file, you can skip that and restore your accounts on the new iPhone; without one, you'll scan Heap's barcode again. See How to transfer your authenticator app to a new iPhone.

Official Heap help

• 2FA
• Where do I manage my personal settings?
• Where do I manage my account settings?
• What is Contentsquare?