Mercado Bitcoin 2FA: how to set up an authenticator app

Mercado Bitcoin (MB) is a Brazilian crypto exchange. You sign in to it with your CPF or CNPJ and a password. Its two-factor authentication (2FA) is a 6-digit code from an authenticator app that changes every 30 seconds, and MB calls the setting Autenticador de saque cripto (crypto withdrawal authenticator). The name gives away the main rule: you can't send crypto out of your MB account until it's on. Once it is, MB asks for the code at every sign-in and on every crypto transfer (Mercado Bitcoin, archived).

MB's help recommends Authy, but this guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Mercado Bitcoin steps come from Mercado Bitcoin's own help articles, linked below. MB's websites blocked our automated reader, and its old help center now redirects to a new support portal that only loads in a full web browser. So on October 21, 2026, we read archived copies of the help articles that web.archive.org saved in 2024. We haven't tested them on an MB account, and labels may have changed since then. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

MB's article describes these steps on its website (Mercado Bitcoin, archived):

1. Sign in on the Mercado Bitcoin website, click your name on the right side of the screen, and open Configurações (Settings).
2. In the left sidebar, find Segurança (Security), then click Autenticador de saque cripto > Como ativar.
3. MB shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
4. Type the 6-digit code from Novaz into MB and click Ativar (Activate).

On a phone, MB says to do this in the web browser, not the MB app. Tap the two lines next to the logo, then go to Configurações > Segurança > Autenticador de saque cripto. If the QR code is on the same iPhone as Novaz, take a screenshot, then in Novaz tap + and Choose a photo. See scanning a QR code on the same iPhone.

MB's article doesn't mention a text key you can type instead of the QR code. If you do see one, tap +, then Enter key manually in Novaz, and paste it as the Setup key.

The 24-hour wait

MB doesn't let crypto out right away. Transfers only go through 24 hours after you turn the authenticator on (Mercado Bitcoin, archived). The same wait applies if you turn it off and set it up again later: Enviar Cripto (Send Crypto) is unavailable for the first 24 hours (Mercado Bitcoin, archived).

No backup codes

MB's help doesn't mention backup or recovery codes. Its recovery article warns that if you lose access to your authenticator app, you can't get into your MB account. It points Authy users to Authy's own backup password and tells everyone else to check how their app handles recovery (Mercado Bitcoin, archived).

Novaz can keep a copy through iCloud backup or a backup file; without one, its keys exist only on your iPhone, and your way back in is MB's reset (below), so keep access to the email address on your MB account and to your ID document.

If Mercado Bitcoin rejects your code

MB's help names the error message: “não foi possível validar o código com a sua conta” (the code couldn't be validated with your account). Its fix is to sync the time. Turn on automatic date and time on your phone, and if you sign in on a computer, check the computer's clock too (Mercado Bitcoin, archived).

On iPhone, go to Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Lost your phone or changing phones

MB's newest article covers both cases with a reset in the MB app. It doesn't ask for a code from the old phone (Mercado Bitcoin, archived):

1. On the MB app's start screen, tap Acessar conta and enter your CPF and password.
2. When MB asks for the authentication code, choose Não tenho acesso ao autenticador (I don't have access to the authenticator), then Desativar (Turn off).
3. Enter the 6-digit code MB sends to your email address.
4. If you've never verified your account before, MB asks for a selfie and an ID document. It says checking them can take up to 5 minutes.
5. Confirm your identity with facial recognition, following the prompts on screen.

MB then confirms on screen and by email. Business accounts (pessoa jurídica), and anyone who gets an error at the end, have to contact MB's support instead.

Afterwards, set up the authenticator again on your new iPhone, and expect the 24-hour wait on crypto transfers. When you're only changing phones, a Novaz iCloud backup or backup file lets you restore the account on the new iPhone instead. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?

An older MB article, from mid-2024, described the reset as a support request with a selfie holding your ID and photos of both sides of it (Mercado Bitcoin, archived).

Official Mercado Bitcoin help (archived copies)

• Autenticador para saques de cripto/2FA: como ativar e qual app usar? (saved December 5, 2024)
• Como desativar o Aplicativo autenticador ou Autenticador de saque cripto (2FA)? (saved December 5, 2024)
• Problemas com o 2FA? (saved December 5, 2024)
• Como recuperar o 2FA / Verificação em Duas Etapas? (saved June 19, 2024)
• Como desativar o 2FA? (saved July 16, 2024)