HubSpot 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your HubSpot login is the one you use for the CRM and HubSpot's marketing, sales and service tools. On a Starter, Professional or Enterprise account, two-factor authentication (2FA) is required if you log in with an email and password: HubSpot asks you to set it up at your first login, and you can't turn it off. On the free tools it's optional unless an admin requires it (HubSpot). The methods are a passkey, an authenticator app and, on paid plans, a text message. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the HubSpot steps come from HubSpot's own Knowledge Base articles, linked below, which we read on October 20, 2026. We haven't tested them on a HubSpot account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- If you sign in with Google or Microsoft, HubSpot won't prompt you, but you can still turn on 2FA.
- Since March 20, 2026, the HubSpot mobile app can't be chosen as a new 2FA method. If you already use it, it keeps working, but once removed it can't be added back (HubSpot).
- On paid plans, a Super Admin can turn on Approved 2FA methods, for example to require an authenticator app instead of texts (HubSpot).
Turn on 2FA with an authenticator app
From HubSpot's Knowledge Base (HubSpot):
- In your HubSpot account, click the settings icon in the top navigation bar.
- In the left sidebar menu, go to General > Security.
- In the two-factor authentication section, click Set up two-factor authentication (2FA).
- Choose Authenticator app.
- Add HubSpot to Novaz (see below), then click Next in HubSpot.
- Type the current code from Novaz and click Next.
- Save your backup codes with Print or Download PDF, then click Next.
- Click Done, or set up a secondary method.
2FA starts the next time you log in.
HubSpot's help doesn't say whether the setup shows a QR code, a text key or both. In Novaz:
- QR code: tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Text key: tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
A typed key always gives 6-digit codes every 30 seconds. HubSpot doesn't publish its code settings, so scan the QR code if you can: it carries them.
Backup codes and a second method
To see your backup codes later, go to General > Security and click View backup codes. Generate new codes makes ten new ones and cancels the old ones (HubSpot).
HubSpot strongly recommends a secondary method too: Text message or Authenticator app, added in the same section. For texts, first use Add a trusted phone number.
Without a Novaz backup (iCloud backup or a backup file), the keys exist only on your iPhone, so your backup codes and secondary method are your way back in. Keep the codes off your phone. See 2FA backup codes.
When HubSpot asks for a code
After a 2FA login, choose Remember me to skip 2FA for 28 days, or Ask every time. If you also have a passkey, either works at login (HubSpot).
If HubSpot rejects your code
For a This doesn't look right error, HubSpot says to check the time on your device (HubSpot). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
For authenticator apps, HubSpot's only new-phone advice is to transfer the setup inside the app. With Novaz, that means iCloud backup or a backup file: restore it on the new iPhone and HubSpot's codes keep working. Without one, you set HubSpot up again on the new iPhone. HubSpot describes that only for a new phone number: click Remove SMS, then Turn off, and set up again (HubSpot). Switch while the old iPhone still works and your backup codes are at hand. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
On the verification screen, click Use a backup code, or use your secondary method or a passkey. With none of these, request a reset (HubSpot):
- Log in at app.hubspot.com/login with your email and password.
- On the 2FA page, click Reset authentication device. Another HubSpot page calls it Lost your authentication device?
- Click Request admin recovery. You get an emailed code to give your Super Admin, who finishes the reset. Your 2FA methods and passkeys are then removed.
- No admin option? Click Verify with photo ID, offered if you're the only Super Admin, there's none, or your user was deactivated. HubSpot's partner Persona checks your ID against your profile name (HubSpot).
- If neither works, use the contact HubSpot support link in the reset email. HubSpot says this takes at least 48 to 72 hours, and support can't turn off 2FA for you any other way.
Once you're back in, set up a new method right away. More in Lost the phone with your authenticator app?
Turning 2FA off
Only on the free tools, or on Professional and Enterprise accounts that require single sign-on. In General > Security, click Remove for each method (for example Remove SMS), enter a code, then click Turn off (HubSpot).
