IBM Cloud 2FA: how to set up an authenticator app

IBM Cloud is IBM's platform for servers, storage, databases and AI services, and you log in to its console at cloud.ibm.com with an IBMid or your organization's sign-in. Its two-factor authentication, called multifactor authentication (MFA), has two parts. An administrator sets a rule on the IBM Cloud account, and each person then adds their own factor: an email code, a time-based code from an authenticator app (TOTP), or a security key (IBM Cloud). If any account you belong to requires MFA, you need it at every login (IBM Cloud). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the IBM Cloud steps come from IBM's own documentation for IBM Cloud and for IBMid, linked below, which we read on October 20, 2026. We haven't tested them on an IBM Cloud account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Step 1: require MFA in the account

If you own the account, you're its administrator. Otherwise, ask whoever runs it (IBM Cloud):

1. In the IBM Cloud console, go to Manage > Access (IAM) > Settings.
2. Click Authentication. IBM's FAQ mentions an Edit button there, so the screen may vary.
3. Pick the MFA type. For an authenticator app, IBM's list of options includes MFA for a user with or without an IBMid - TOTP MFA.

IBM ranks the factors: email is level 1, TOTP level 2, a security key level 3, and a higher level always meets a lower requirement (IBM Cloud). The rule reaches each member at their next login.

Step 2: add the authenticator app

IBM Cloud walks you through this at your first login after the rule changes (IBM Cloud). You can also do it yourself (IBM Cloud):

1. Open the Verification methods and authentication factors page.
2. Prove who you are with two verification methods (email, text message or phone call): enter each one-time password and click Verify. IBM asks for this each time you open the page.
3. Click Show authentication factors, then Add.
4. Select TOTP and give it a name.
5. In Novaz, tap +, then Scan QR code, and point the camera at the code. If it's on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
6. Enter the code from Novaz and click Complete.

IBM's pages show only a QR code here and don't mention a text key, so scan it.

The IBMid option

The other TOTP rule, MFA for a user with an IBMid (IBM Cloud), checks a code tied to your IBMid, the login you also use for other IBM services (IBMid). IBMid's own enrollment: choose Authenticator app, name it, click Proceed enrollment, scan the QR code and enter the 6-digit code (IBMid). Skip the IBM Verify app option, which approves logins by push notification. Novaz only makes codes.

No backup codes

Neither IBM Cloud nor IBMid mentions backup codes. Both say to add more than one factor (IBM Cloud, IBMid). Novaz's keys stay on your iPhone unless you back them up, so add a second factor too. Under a TOTP rule, a security key counts, since it's a higher level. Keep a spare verification method as well.

When IBM Cloud asks for a code

At every console login once MFA applies to you. API calls aren't covered: user and service ID API keys keep working (IBM Cloud).

If IBM Cloud rejects your code

For Error: Incorrect validation code., IBM assumes you've lost access to a factor and points to the reset below (IBM Cloud). IBMid's help blames bad codes on time sync and a wrong time zone (IBMid). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?

Changing phones

Add the new phone first: Show authentication factors > Add > TOTP gives a fresh QR code (IBM Cloud). Then select the old factor, click Remove and confirm with Yes. In IBMid, use Add new methods, then delete the old one. If you restore your Novaz accounts on the new iPhone from iCloud backup or a backup file, the existing TOTP factor keeps working and you can skip this. See moving your authenticator to a new iPhone.

If you lose your authenticator

Open the Verification methods and authentication factors page, verify with two methods, click Show accounts and check each account's authentication setting (IBM Cloud):

• All users: tick the box next to the lost factor and click Remove. You set up a new one at your next login.
• IBMid users: sign in to your IBMid security settings using your email as the second factor, open the three dots next to the lost factor and delete it (IBMid). If that fails, IBMid lists ibmidsupport@ibm.com, though it plans to move requests to a chat assistant at ibm.com/account on a date it hasn't set (IBMid).

If you can't pass the two verification methods, a support case can reset them (IBM Cloud). Locked out entirely, use IBM's Create an Account, Login or Billing Request form (IBM Cloud). IBMid support may ask you to confirm your IBMid by email. Neither says how long it takes. See also Lost the phone with your authenticator app?

Turning it off

An administrator selects None under Manage > Access (IAM) > Settings > Authentication, for the whole account (IBM Cloud). CLI logins with only a password are then blocked by default.

Older classic infrastructure accounts may also show Legacy account-based MFA. IBM has deprecated it and asks each user to remove it once IBM Cloud MFA is set up (IBM Cloud).

Official IBM Cloud help

• IBM Cloud multifactor authentication
• Enabling MFA in your account
• Managing verification methods and MFA factors
• FAQ about IAM
• Why can't I log in with my MFA factors?
• Migrating to IBM Cloud MFA
• Creating support cases in IBM Cloud
• Security and IBMid
• MFA Enrollment on IBM Security Verify App (IBMid)
• MFA Reset for IBMid
• Troubleshooting IBMid
• Contact Support - Worldwide Help desk (IBMid)