Hugging Face 2FA: how to set up an authenticator app

Your Hugging Face account is the one behind your models, datasets and Spaces on huggingface.co, and behind any organizations you belong to. Its two-factor authentication (2FA) has a single method: a six-digit code from an authenticator app. The docs give Authy, Google Authenticator, Microsoft Authenticator and FreeOTP as examples and don't mention text-message codes at all (Hugging Face). 2FA is optional for you, but an organization on a Team or Enterprise plan can require it of every member (Hugging Face, Hugging Face).

One detail sets Hugging Face apart: if you lose both the app and your recovery codes, support asks for a second kind of proof, such as an SSH key or an access token on your account.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Hugging Face steps come from the Hugging Face Hub documentation, linked below, including the screenshots on its 2FA page, which we read on October 20, 2026. We haven't tested them on a Hugging Face account. The written steps and the screenshots don't always use the same labels, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

These steps follow Hugging Face's 2FA page and its screenshots (Hugging Face):

1. Sign in on huggingface.co and go to huggingface.co/settings/authentication. It's the Authentication tab of your settings, headed Authentication Settings.
2. Under Two-Factor Authentication, select Add Two-Factor Authentication.
3. A QR code appears. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. Below the QR code, Hugging Face also shows a setup key for adding the account by hand. In Novaz, tap +, then Enter key manually, and type it as the Setup key, with "Hugging Face" as the Service. See What is a 2FA setup key?
5. Type the code from Novaz into 6-digit code from the app and select Save. The written steps call this field Code.
6. Hugging Face now lists your recovery codes. Use Download or Copy to keep them. A download arrives as huggingface-recovery-codes.txt.

The docs ask for six digits but never say how often the code changes. Scanning is the better choice: the QR code tells Novaz the timing, while a typed key gets the standard 30 seconds.

Your recovery codes

Each recovery code works for one sign-in and is then used up. The screen that shows them suggests keeping them in a password manager (Hugging Face). Keep them even if you back up Novaz: if the phone is gone and you have no Novaz backup, or it's older than this account, the codes are what gets you back in.

For a fresh set, go back to your authentication settings, select Recovery Code, then Regenerate recovery codes. The old set stops working at once. See 2FA backup codes.

When Hugging Face asks for a code

With 2FA on, the website asks for a code after your password at every sign-in, and again every 30 days (Hugging Face). The prompt is a page titled Two-factor authentication with a 6-digit code box and a Verify button.

For git and the Python libraries, the docs point you to user access tokens instead, which take the place of your password (Hugging Face).

If Hugging Face rejects your code

The docs give no advice for a code that doesn't work. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz shows a warning when the clock is off by 15 seconds or more. If you typed the key by hand, add the account again by scanning the QR code. More causes are in Authenticator code not working?

Moving to a new phone

Hugging Face doesn't describe moving 2FA to another device. What its docs do cover is removing 2FA and adding it again, so do that while the old phone still works, and save the new recovery codes. With Novaz, you can skip this by restoring your accounts on the new iPhone from iCloud backup or a backup file. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a recovery code. Sign in with your username or email and password as usual. At the code prompt, under Lost access to your two-factor authentication app?, choose Use a recovery code and enter one of your codes (Hugging Face). Once you're in, remove 2FA and set it up again on your new phone.

Without a recovery code, email Hugging Face support at website@huggingface.co. You'll have to prove who you are with "a recovery authentication factor", and the docs give an SSH key or a personal access token as examples (Hugging Face). They don't list other kinds of proof or say how long recovery takes.

So if you have neither, consider adding one now. You can add an SSH key to your account (Hugging Face), or create a token with New token on the Access Tokens tab (Hugging Face). A token can stand in for your password with git, so guard it like one. More in Lost the phone with your authenticator app?

Turning 2FA off

In your authentication settings, select Remove. Hugging Face says this clears every 2FA registration on the account (Hugging Face). The docs don't say whether it asks for a code first. In Novaz, open the account and tap Remove account once you no longer need it.

Official Hugging Face help

• Two-Factor Authentication (2FA)
• User access tokens
• Git over SSH
• Advanced Security
• Team & Enterprise plans