Klaviyo 2FA: how to set up an authenticator app

Klaviyo, the email and SMS marketing platform many online stores run on, requires two-factor authentication on every paid account. It calls it multi-factor authentication (MFA), and the only way out is a single sign-on (SSO) requirement set by your company (Klaviyo). Free accounts can choose.

You can use an authenticator app or text messages, and Klaviyo calls the app the more secure of the two. SMS codes aren't offered in some countries, including China, Russia and Iran, so there the app is your only method (Klaviyo). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Klaviyo steps come from Klaviyo's own Help Center articles, linked below, which we read on October 20, 2026. We haven't tested them on a Klaviyo account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Klaviyo's setup article describes these steps (Klaviyo):

1. Click your account name in the bottom left corner, then Settings, then Security.
2. In the MFA methods section, click Add method and choose Set up authenticator app.
3. Enter your Klaviyo password. A setup page with a QR code opens.
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. If Klaviyo is open on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. Once Novaz shows a Klaviyo code, click Continue in Klaviyo.
6. Type the current code and click Continue.
7. Click Copy codes or Download (.txt) to save your backup codes, then click Finish.

Klaviyo doesn't say what a typed key is called or how long its codes are, so scan the QR code if you can. To type a key instead, use + > Enter key manually and paste it as the Setup key (Novaz then makes 6-digit, 30-second codes). See What is a 2FA setup key?

If the code is refused during setup, Klaviyo says to try once more with a fresh code, and if that fails, to delete the entry in your app and scan again (Klaviyo). In Novaz, open the account and tap Remove account.

Only four backup codes

The backup codes are strict (Klaviyo, Klaviyo):

• You get four, shown once. Close the window and they're gone.
• Each works one time, and you can't generate more. When you run out, you reset MFA and set it up again.
• They only cover the authenticator app, not SMS MFA.

Without a Novaz backup, or with one older than your Klaviyo entry, those four codes are your way back in. Keep them in a password manager or printed out, not on the phone itself. See 2FA backup codes.

When Klaviyo asks for a code

You need your password plus a fresh code every time you log in. With both methods set up, Klaviyo asks for the app code (Klaviyo). A session then lasts up to 7 days instead of 24 hours (Klaviyo).

Don't mix it up with the trusted device code: an emailed code Klaviyo sends the first time you log in on a new device. Check Don't ask again for this device to skip it there in future (Klaviyo).

If Klaviyo rejects your code

Klaviyo's FAQ points to time: authenticator codes depend on UTC time, so a phone clock that's off, or a time zone mix-up while traveling, breaks them (Klaviyo). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Changing phones

If you back up Novaz with iCloud backup or a backup file, restore it on the new iPhone and Klaviyo comes with it. Without a backup, set Klaviyo up again while you can still log in. A paid account can't drop its only MFA method, so add a second one first (Klaviyo):

1. In Settings > Security, click Add method and choose Set up SMS notification.
2. In the 3-dot menu next to the authenticator app, click Disable, enter a code from the old phone, and click Disable again.
3. Add the authenticator app again with Novaz on the new iPhone, and save the new backup codes.

Free accounts can skip step 1. Klaviyo doesn't cover phone changes where SMS isn't offered; an Owner or Admin reset (below) also leads to a fresh setup. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use a backup code to log in, then replace the authenticator as described under Changing phones.
2. Ask an Owner or Admin. They open the Users tab, click the 3 vertical dots next to your name, select Reset MFA, and confirm with Reset. You then have 12 hours to open the "MFA reset request" email and select Accept (Klaviyo). Klaviyo Support can't do this for users in your account.
3. If you're the only Owner or Admin, or they're unavailable, contact Klaviyo Support through its account access request form (Klaviyo). You'll have to verify your identity, which may take several days; Klaviyo doesn't say what proof it wants (Klaviyo).

More in Lost the phone with your authenticator app?

Turning MFA off

Paid accounts can only switch methods, not remove them all, unless SSO is required. On a free account, open the 3-dot menu next to the method in Settings > Security, click Disable or uncheck Require for your account, enter a code, and click Disable. Free account Owners can also turn Require for all users in your organization on or off there (Klaviyo).

Official Klaviyo help

• How to set up multi-factor authentication (MFA)
• Multi-factor authentication (MFA) FAQs
• How to reset multi-factor authentication for a user
• How to add trusted devices
• How to update your account email and password in Klaviyo
• How to contact support