Mailgun 2FA: how to set up an authenticator app

Mailgun, the email-sending service from Sinch, keeps your API keys, SMTP passwords and sending domains in its Control Panel. Two-factor authentication (2FA) is optional unless an admin on your account requires it. The catch: Mailgun has two versions of 2FA right now, and the steps for one can break sign-in on the other. This guide shows how to tell them apart and set up each with Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Mailgun steps come from Mailgun's own help center, linked below, which we read on October 21, 2026. The article pages refuse automated requests, so we read them through the help center's public article feed on help.mailgun.com. We haven't tested the steps on a Mailgun account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, check which sign-in your account uses

Sinch is moving Mailgun accounts to a shared sign-in called Sinch Identity. If yours has moved, new login screens appear after you enter your email at login.mailgun.com (Mailgun). Another sign is a Sinch ID badge on at least one user on your account's Users page.

Mailgun warns that running the classic steps on a Sinch Identity account will stop you from signing in, so check first (Mailgun).

If you reach Mailgun through Rackspace or Heroku, 2FA is handled by that service, not by Mailgun.

Set up 2FA with Sinch Identity

Mailgun's compromised-account article gives the short version (Mailgun):

1. In the Control Panel, open the Profile menu at the top right and click Manage my Sinch ID.
2. On Sign-in & Security in My Profile, click Configure 2FA.
3. Pick the authenticator app (SMS is the other choice), then follow the screens. If you're shown a QR code, scan it in Novaz with + > Scan QR code.

Mailgun's pages don't show those screens or mention a setup key or backup codes. Once it's on, Sinch Identity asks for a 6-digit code at every Control Panel sign-in (Mailgun).

Set up 2FA on a classic Mailgun login

The classic setup has two layers: 2FA is first activated for the account, then each user turns it on for their own login (Mailgun).

Activate it for the account:

1. Sign in to the Mailgun Control Panel, open the Profile menu at the top right and click Manage Account.
2. In Mailgun settings, find Two-factor Authentication (2FA) and click Activate 2FA.
3. Before anything else, click Download Key. That saves the 64-character "paper key" as a .txt file. Store it somewhere safe, away from your phone.
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the code is on the same iPhone, take a screenshot and use Choose a photo (how that works).
5. Click Continue 2FA Activation, type the 6-digit code from Novaz and click Activate. Mailgun signs you out so you can sign back in with a code.

If you close the pop-up halfway, delete the new entry in Novaz and start again.

Then for your own user: open Profile > Users, find your row under Control panel logins, click Activate, and repeat steps 3 to 5.

Scan the QR code instead of typing the key

Under the QR code, Mailgun shows a 16-character token, which is the setup key (what a setup key is). Its help page also says the codes change every 60 seconds. If so, typing the token with Enter key manually would fail, because manual entry always uses 30 seconds. A QR code carries the right interval, so scan it, then tap the account in Novaz and check Interval under Details.

Mailgun also says the token itself can be typed in place of a 6-digit code at sign-in. Treat it like a password: keep it in a password manager, or don't keep it at all.

Make 2FA required for everyone

An admin with 2FA on can click Require TFA next to Force User Auth Scheme under Manage Account > Mailgun settings. Clear all user sessions makes everyone set it up now; Allow user sessions to stay logged in waits until each session ends.

When Mailgun asks for a code

On a classic login, Mailgun says you may be asked for a code at sign-in "depending on account and user session settings" (Mailgun), without explaining those settings. Sinch Identity asks every time.

If Mailgun rejects your code

Mailgun's help doesn't cover rejected codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If you typed the token by hand, the interval may be wrong: remove the account and scan the QR code instead. More in Authenticator code not working?

If you lose your authenticator

Your paper key is the way back in (Mailgun):

• Classic login: go to Mailgun's 2FA recovery page, login.mailgun.com/recovery/2fa, enter the paper key and click Deactivate 2FA. Then sign in with your email and password and set up 2FA again.
• Sinch Identity: click Try another method at the code prompt and choose one of the options offered.
• No paper key, account owner: contact Mailgun Support, which takes you through some verification steps. Mailgun doesn't say what proof it asks for or how long it takes.
• No paper key, not the owner: ask the account owner to delete your user under Users and invite you again with Invite new user. You then set up 2FA from scratch.

If you turned on Novaz's iCloud backup or kept a backup file, restoring it on a new iPhone brings your Mailgun codes back. Without one, the paper key is your real backup. See 2FA backup codes and Lost the phone with your authenticator app?

Changing phones or turning 2FA off

Mailgun's help doesn't describe moving 2FA to a new phone or switching it off in settings. The only documented way off is the paper key route above; then set it up again on the new phone. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead. Without one, keep the old phone until the new one works. See How to transfer your authenticator app to a new iPhone.

Official Mailgun help

• Two-Factor Authentication (2FA)
• Resetting and deactivating 2FA
• SSO via Sinch Identity
• What can I do if my account has been compromised?