Mapbox 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Mapbox account holds your access tokens, map styles, tilesets and billing. Two-factor authentication (2FA) is optional, though Mapbox recommends it. The only second factor Mapbox documents is a 6-digit code from an authenticator app, entered after your password (Mapbox). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Mapbox steps come from Mapbox's own documentation, including its screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a Mapbox account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Check your payment method first
When someone is locked out, Mapbox confirms the account is theirs through the payment method on file, such as the last 4 digits of a card or bank account. If the account has 2FA but no payment method, Mapbox says "there is no way that the Support team can help" (Mapbox). Its only suggestion then is a new account, with your apps switched to its access tokens (Mapbox).
Mapbox lets you sign up without a credit card (Mapbox). If your account has no card, the recovery code is your only way back in.
Turn on 2FA with an authenticator app
Mapbox's documentation and its screenshots show these steps (Mapbox):
- Sign in to the Mapbox Console and open your settings with the gear icon in the bottom-left corner.
- Select Security. Under Two-factor authentication, turn the switch on (it reads OFF until 2FA is set up).
- The Set up two-factor authentication window shows a barcode under Scan this barcode with an authenticator app. In Novaz, tap +, then Scan QR code. If the barcode is on the same iPhone, take a screenshot, tap + and Choose a photo. See scanning a QR code on the same iPhone.
- If you can't scan, use the text key shown under Can't scan the barcode? Enter the following code manually:. In Novaz, tap +, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key?
- Type the code from Novaz into Enter the 6-digit code from the application and select Continue.
- Mapbox then takes you to a page with your recovery code. Save it before you leave.
The window recommends Google Authenticator, but any authenticator app works. Mapbox doesn't say how often its codes change, so scan the barcode if you can: a typed key always gets 6 digits every 30 seconds in Novaz.
Your recovery code
Mapbox's docs describe one recovery code, not a list. It works once and gets you in without your phone (Mapbox). Using it also switches 2FA off for now, so set 2FA up again afterwards and save the new code.
Lost the code but still have Novaz? Generate a new one on the Security page. Unless you've turned on Novaz's iCloud backup or exported a backup file, the Mapbox key exists only on the iPhone you set it up on, which makes this code your fallback. Keep it away from that phone, in a password manager or on paper. More in 2FA backup codes.
Shared and team accounts
Once 2FA is on, everyone who signs in with the account's password needs a code. Mapbox suggests passing the recovery code to the new owner when an account changes hands, and SAML single sign-on for accounts with several users (Mapbox). When a team moves to single sign-on, Mapbox says to turn 2FA off or keep the recovery code with the new password (Mapbox).
When Mapbox asks for a code
Mapbox asks at every sign-in with the password, and when you change the password on the Change password page (Mapbox). The docs don't mention trusting a browser to skip the code.
If Mapbox rejects your code
Mapbox's pages don't cover rejected 2FA codes. The usual culprit is the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For sign-in problems in general, Mapbox's checklist asks whether you've tried a private window without browser extensions (Mapbox). More in Authenticator code not working?
Changing phones or turning 2FA off
Mapbox doesn't give steps for either. Its docs only say the Security page is where you change two-factor authentication. Make the change before you wipe or hand back the old iPhone, then make sure you hold a current recovery code. If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and Mapbox comes with it. Without one, Mapbox has to be added on the new phone from scratch. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
With your recovery code (Mapbox):
- On the Mapbox sign-in page, enter your account ID (username) or email and your password, then select Sign in.
- Select Lost your mobile device? below the Sign in button.
- Enter the recovery code in the new field and select Sign in.
- 2FA is now off. Set it up again on your new phone.
Without it, use Mapbox's support form, or your Account Manager for a team account. Mapbox must verify you own the account, which for a personal account requires a payment method on file. If that works, it removes 2FA so you can sign in with the password (Mapbox). Include as much as you can: account ID, registered email, an invoice number, an access token or style URL, and the last 4 digits of the card or bank account. Mapbox aims to reply within 2 business days. See also Lost the phone with your authenticator app?
