Intigriti 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Intigriti is a bug bounty and vulnerability disclosure platform. Researchers use their account to join programs and submit reports, and company users use theirs to run programs and triage findings. For researchers, two-factor authentication (2FA) is more than a safety extra: some programs only let you in once it's on. Intigriti's only documented second factor is an authenticator app, with backup codes as the fallback (Intigriti). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Intigriti steps come from Intigriti's own help center, linked below, which we read on October 21, 2026. We haven't tested them on an Intigriti account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Why researchers turn it on
A company can switch on a program setting that enforces two-factor authentication. On such a program, a researcher without 2FA sees only the program description and the bounty table, and the company can't invite them. If you turn 2FA on later, full access to the program comes back right away (Intigriti).
For company users the picture is different. Intigriti says a company can't enforce 2FA for its own members: each member who signs in with a password decides for themselves (Intigriti).
Turn on 2FA with an authenticator app
Intigriti's help article, last updated in August 2024, gives these steps (Intigriti):
- Sign in to Intigriti and open your profile menu.
- Click Edit Settings.
- Select 2FA.
- Select the option to set up an authenticator app. Intigriti's page names Microsoft Authenticator and Google Authenticator as examples, but you can use any app.
- Intigriti shows a QR code and a key. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If you'd rather type the key, tap + in Novaz, then Enter key manually. Fill in Service (for example, Intigriti), Account if you like, and paste the key as the Setup key. See What is a 2FA setup key?
- Intigriti then shows your backup codes. Save them before you go on (more below).
- Type your Intigriti password and the current code from Novaz into the confirmation fields, then select verify.
The help page's screenshots stop at a confirmation that the feature is on. Intigriti doesn't say how many digits its codes have or how often they change. Scanning the QR code avoids any mismatch, because the code carries those settings to the app.
Save the backup codes
The backup codes appear in the middle of setup, before you confirm with your password. That makes them easy to click past, so copy them somewhere safe right then: a password manager, or paper kept away from your phone. Intigriti's page doesn't say how many codes you get, whether each works once, or whether you can make a new set later.
Keep them even if you back up Novaz: they get you in if the phone is lost and you have no Novaz backup, or your last backup file is older than this account. See 2FA backup codes.
Signing in afterwards
Once 2FA is on, Intigriti asks for a one-time code from your app after your email and password (Intigriti, Intigriti). The help pages don't mention a way to trust a device and skip the code.
If Intigriti rejects your code
Intigriti's help center has no advice for rejected codes. Start with your iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also check that you typed the code shown under the Intigriti entry and not another account's. More causes are in Authenticator code not working?
If you lose your authenticator
On the screen that asks for your code, choose the option to use a backup code instead of an app code. If you've lost your backup codes too, Intigriti says to contact its support team, who will help you recover the account (Intigriti). It doesn't say what proof it asks for or how long recovery takes. Its support team works 09:00 to 17:00 CET, Monday to Friday, on business days (Intigriti).
The help pages don't describe changing phones or turning 2FA off, either. In Novaz, an iCloud backup or a backup file lets you restore the Intigriti entry on the new iPhone. Without one, don't wipe or give away the old phone while it's the only place your Intigriti codes come from, and keep your backup codes at hand. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
Company users on single sign-on
If your company admin switches you to single sign-on, you sign in through your company's identity provider instead. Intigriti then deletes your Intigriti password and your 2FA backup codes for good (Intigriti). From then on, 2FA is whatever your company's provider requires, and the Novaz entry for Intigriti is no longer used. You can remove it: open it in Novaz and tap Remove account.
