Looker 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Looker is Google Cloud's business intelligence platform, where your company's dashboards, Looks and Explores live. Its two-factor authentication (2FA) works differently from most services: you don't turn it on for yourself. A Looker admin switches it on for the whole instance, and from then on everyone who signs in with an email address and password needs a code from an authenticator app. Looker can't require it for only some users (Looker).
Looker's documentation names Google Authenticator but says any third-party authenticator app works. This guide uses Authenticator App - Novaz on iPhone, and the steps are the same in other apps.
How we checked this guide: the Looker steps come from Looker's own documentation on Google Cloud, linked below, which we read on October 21, 2026. We haven't tested them on a Looker instance, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Does this apply to your Looker?
It depends on how you sign in and which kind of Looker your company runs.
- Looker (original), email and password: yes. This is the sign-in that Looker's own 2FA protects.
- Sign-in through LDAP, SAML, OpenID Connect or Google OAuth: Looker's 2FA doesn't apply to those sign-ins. Any extra check comes from that outside system. It does apply to the alternate email login that some admins keep as a backup (Looker, Looker).
- Looker (Google Cloud core): the Two-Factor admin page isn't available there, and neither are passwords (Looker). You sign in with your Google identity, so 2FA is set on that account instead.
The Looker API isn't affected by 2FA.
For admins: turning it on
In the Admin panel, open the Two-Factor Authentication page in the Authentication section and enable it (Looker). Looker signs out everyone who is signed in at that moment, so pick a quiet time and warn your users first. Each of them then sets up an authenticator app the next time they sign in.
Set up your authenticator app at first sign-in
Once your admin has turned it on (Looker):
- Sign in to your Looker instance on your computer with your email address and password.
- Looker shows a QR code on the screen. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're signing in on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, Looker offers to show a text code. In Novaz, tap +, then Enter key manually, and type that code as the Setup key. See What is a 2FA setup key?
- Type the code that Novaz now shows to finish signing in.
Looker's documentation doesn't give the exact button labels on these screens, and it doesn't say how many digits the codes have or how often they change. Scanning the QR code is the safer choice, since it passes those settings to your app.
When Looker asks for a code
After setup, Looker asks for a code each time you sign in, right after your username and password. If you check This is a trusted computer, that browser can sign in with just your password for 30 days. After that, Looker asks for a code again (Looker).
No backup codes
Looker's documentation doesn't mention backup or recovery codes, or any second method. If you lose your authenticator, the way back in is your Looker admin (below). Unless you've made a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, so know who your admin is before you need them.
If Looker rejects your code
Looker codes depend on time. Looker says the server and your phone must agree on the time, and it tells users to let their phones set the time automatically. An admin can set how much difference Looker tolerates, and the default is 90 seconds (Looker).
On your iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
If your phone's clock is right and codes still fail for everyone, the problem may be on the server. For a Looker instance your company hosts itself, Looker says the server needs NTP running. Tell your admin. More causes are in Authenticator code not working?
New phone or lost phone
You can't reset Looker 2FA yourself. Your admin does it: on the Users page in the Admin panel, they click Edit on your row, then Reset under Two-Factor Secret. The next time you sign in, Looker shows a new QR code to scan (Looker, Looker). Looker lists a new phone as one reason for this reset.
If you restore Novaz on a new iPhone from an iCloud backup or backup file, Looker comes with it. Without one, a new iPhone means asking for this reset and scanning again. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
Turning 2FA off
Looker's documentation doesn't describe a way for a single user to opt out, which fits with 2FA covering everyone on the instance. The setting lives on the admin Two-Factor Authentication page, so it's a question for your Looker admin.
