Skip to content
Novaz AuthenticatorGET

Heroku 2FA: how to set up an authenticator app for MFA

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Add an authenticator app
  2. Add recovery codes as well
  3. When Heroku asks for a code
  4. If Heroku rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Official Heroku help

Your Heroku account is the one behind the Heroku Dashboard and the Heroku CLI, where you deploy and run apps. Heroku, part of Salesforce, calls two-factor authentication multi-factor authentication (MFA), and it isn't optional. Since January 10, 2023, every user who doesn't sign in through company single sign-on (SSO) has to use it, and new accounts set it up at sign-up (Heroku). Heroku doesn't document any way to turn it off.

You can verify with Salesforce Authenticator, an authenticator app, a security key, or a built-in authenticator such as Touch ID. Codes by text, email or phone call don't count (Heroku). If your company's Heroku Enterprise Account uses SSO, your identity provider handles MFA instead (Heroku).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app that makes time-based codes works the same way.

How we checked this guide: the Heroku steps come from Heroku's own Dev Center and help articles, linked below, which we read on October 20, 2026. We haven't tested them on a Heroku account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Add an authenticator app

Heroku's Dev Center describes these steps (Heroku):

  1. Sign in to the Heroku Dashboard and open Account Settings.
  2. Select Setup Multi-Factor Authentication. If you already have a method set up, the button reads Manage Multi-Factor Authentication.
  3. Click Add One Time Password Generator. Heroku shows a QR code.
  4. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  5. If you can't scan it, Heroku offers a setup key instead, through a link under the buttons. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
  6. Type the code from Novaz in Heroku and click Connect.
  7. Add recovery codes (next section), then click Done. Heroku emails you about each new method (Heroku).

Heroku doesn't say how many digits its codes have or how often they change. Scan the QR code if you can, because it carries those settings. A key typed by hand always gets 6 digits every 30 seconds.

Add recovery codes as well

In Heroku, recovery codes are a separate method that you add yourself: on the same page, choose Add Recovery Codes. Heroku shows 10 single-use codes, with Copy, Download and Print buttons. Unused codes stay valid, and you can make a new set at any time (Heroku).

Keep these codes even if you back up Novaz: without iCloud backup or a backup file, its keys are only on your iPhone. Store them away from your phone. Heroku's lockout page assumes you got codes when you turned MFA on. If you don't remember saving any, add a set now. See 2FA backup codes.

When Heroku asks for a code

Heroku asks for MFA at every Dashboard sign-in, including after a session expires and when the CLI sends you to the browser. There's no trusted-device option: "The frequency of MFA challenges can't be modified" (Heroku).

  • A Dashboard session lasts 24 hours and keeps extending with activity, up to 10 days. A CLI session lasts 30 days (Heroku).
  • heroku login opens a browser to sign in; --interactive doesn't work with MFA.
  • API keys work without MFA, but viewing or creating one needs an MFA sign-in (Heroku).

With several methods registered, Heroku asks first for the one it ranks highest, and authenticator apps rank last, after built-in authenticators, Salesforce Authenticator and security keys (Heroku). You can pick another method on the sign-in screen.

If Heroku rejects your code

Heroku's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Heroku has no page about new phones, only about adding methods (Add) and deleting them (the trash icon) under Manage Multi-Factor Authentication (Heroku). Make the switch while you still have the old phone, with recovery codes ready, since Heroku doesn't say whether two authenticator apps can be registered at once. Add Heroku to Novaz on the new iPhone, then delete the old entry.

If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead, and Heroku keeps working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

  • Recovery code or another method. After your password, click Didn't receive a notification?, then Choose Another Verification Method, then Recovery Codes, and enter one (Heroku). Once in, delete the lost authenticator and set up a new one.
  • Heroku Enterprise Account members. An admin with manage permission and MFA on can email you a one-time token: Access tab, the pencil icon next to you, Send MFA Recovery Token. It works for 24 hours (Heroku).
  • Everyone else. Heroku's lockout page, updated in October 2026, says to start a chat with Get Help With Locked Account, using your account's email address (Heroku). Older help articles say to email support@heroku.com from it. Heroku may ask for more information to confirm it's you, but doesn't say what, or how long it takes (Heroku).

If you've also lost access to that email address, Heroku says it can't help you get back in. More in Lost the phone with your authenticator app?

Official Heroku help

More guides: Hosting and cloud