Matomo Cloud 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Matomo Cloud is the hosted version of the Matomo web analytics platform. You sign in at your own address, such as example.matomo.cloud or example.innocraft.cloud (Matomo). Two-factor authentication (2FA) is optional unless a superuser on your instance requires it. It works one way: a code from an authenticator app, which Matomo's screens call an OTP app, with recovery codes as the fallback (Matomo source). The order is unusual: Matomo hands you the recovery codes before it shows the QR code. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Matomo Cloud steps come from Matomo's own help pages and from the Matomo source code it publishes on GitHub, which gave us the screen labels. We read them on October 20, 2026. We haven't tested them on a Matomo Cloud account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
- Sign in at your Matomo Cloud address and go to Administration > Personal > Security (Matomo).
- Click Turn on two-factor authentication, then confirm your password (Matomo source).
- Step 1 - Recovery codes: click Download, Print or Copy to save your recovery codes. Next stays disabled until you do (Matomo source). Then click Next.
- Step 2 - Set up an OTP app on your device: click Show codes. A window, Your two-factor authentication secret, shows a QR code with the key as text below it.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If Matomo is open on the same iPhone, take a screenshot and use Choose a photo instead (scanning a QR code on the same iPhone).
- Or tap +, then Enter key manually, and paste the text key as the Setup key. Matomo uses standard 6-digit, 30-second codes and a 16-character key, so this works (Matomo source, Matomo source). More in What is a 2FA setup key?
- Click Continue in the window.
- Step 3 - Confirm setup: type the code from Novaz into Authentication code and click Confirm.
The page then says Your account is now more secure., and Matomo emails you that 2FA is on (Matomo source).
In Novaz, look for your Matomo address rather than the Matomo name: by default the entry reads like Analytics - example.matomo.cloud, with your username as the account (Matomo source).
Your recovery codes
You get 10 codes, each 16 characters long, shown in groups of four (Matomo source). Each one works a single time. Matomo suggests a password manager for them (Matomo). Novaz's keys stay on your iPhone unless you turn on iCloud backup or export a backup file, so keep these codes as your way back in.
Running low? On the security page, click Show recovery codes, confirm your password, then Generate new recovery codes. The old set stops working at once (Matomo source). One Matomo help page points to Personal > Settings for this, so labels may differ on your instance. See 2FA backup codes.
When Matomo asks for a code
Every time you sign in (Matomo). After your username and password, a Two-factor authentication screen asks for an Authentication code; click Verify (Matomo). Matomo's pages mention no option to remember a device.
API requests and auth tokens are different: there, Matomo says "the two-factor authentication code is not being verified" (Matomo). Guard your auth tokens as carefully as your password.
A superuser who already uses 2FA can make it mandatory under Administration > System > General settings > Two Factor Auth, with Require two-factor authentication for everyone (Matomo, Matomo). Other users then have to set it up the next time they sign in (Matomo source).
If Matomo rejects your code
Matomo accepts codes up to about a minute early or late, but refuses one already used in the last 10 minutes. If you just signed in elsewhere, wait for a fresh code (Matomo source).
Otherwise, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones
Do this while the old phone still works. On the security page, click Set up a new device. Matomo warns that the old device stops working and runs the same three steps. Step 1 shows your existing recovery codes rather than new ones (Matomo source). If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead; see How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- You have a recovery code: enter it in the Authentication code field, click Verify, then set up your new phone right away (Matomo).
- No codes left: ask a superuser on your Matomo instance for a reset (Matomo). The code screen's Ask a superuser to reset your authentication code link drafts that email for you (Matomo source). They edit your user under Administration > System > Users (Matomo) and use Reset two-factor authentication on its Two-factor authentication tab (Matomo source).
- You're the superuser: contact Matomo Cloud support at support@matomo.cloud (Matomo). Matomo doesn't say what proof support asks for or how long a reset takes.
More in Lost the phone with your authenticator app?
Turning 2FA off
On the security page, click Turn off two-factor authentication, answer Yes, and confirm your password. Matomo emails you about the change. The button isn't there when a superuser requires 2FA for everyone (Matomo source, Matomo source).
