MongoDB Atlas 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your MongoDB account signs you in to MongoDB Atlas, the cloud database, and also to the Support portal, MongoDB University and the forums. Multi-factor authentication (MFA) on it isn't optional: MongoDB began making it mandatory on March 26, 2025, and if you haven't chosen a method, Atlas emails you a one-time code at every sign-in (MongoDB).
An authenticator app is one of the methods you can pick instead, next to a security key or biometrics, Okta Verify and email. SMS is deprecated and closed to new sign-ups (MongoDB). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the MongoDB steps come from MongoDB's own documentation and blog, linked below, which we read on October 20, 2026. We haven't tested them on a MongoDB Atlas account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
First, check how you sign in
- Email and password: this guide is for you.
- Google or GitHub: you can't use Atlas MFA. Turn on 2-step verification in that account instead (MongoDB).
- Your company's single sign-on (federated authentication): MFA is set up in your company's identity provider, not in Atlas (MongoDB).
An Organization Owner with MFA on can require it for all members: in Organization Settings, toggle Require Multi-Factor Authentication (MFA) to On (MongoDB). Members without it can't reach the organization until they set it up (MongoDB).
Turn on 2FA with an authenticator app
MongoDB's MFA page gives these steps (MongoDB):
- In the Atlas console, click your name in the upper right corner, then Manage your MongoDB Account.
- In the left-side navigation, click Login and Security.
- Find Authenticator App among the methods and click Set up to its right.
- Atlas shows a QR code (MongoDB's page calls it a bar code). In Novaz, tap +, then Scan QR code, and point the camera at it. If Atlas is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz into Atlas.
MongoDB's steps only describe scanning, and don't say whether Atlas offers a text key or how often codes change. Scanning is safer, because the QR code carries those settings. If you do find a key, use + > Enter key manually and the Setup key field; Novaz then makes 6-digit codes every 30 seconds. See What is a 2FA setup key?
A second method instead of backup codes
Atlas's MFA documentation doesn't mention backup or recovery codes. Its answer to lockouts is a second method: "Enable a minimum of two methods", it says, and with fewer than two, Atlas asks you to add one when you log in (MongoDB).
MongoDB also suggests cloud backup in your authenticator app. In Novaz that's iCloud backup, or you can export a backup file; without either, its keys exist only on your iPhone. A second method is still your best fallback. Add it on the same Login and Security page:
- Security Key / Biometrics: a FIDO2 key such as a YubiKey, or Windows Hello. Support depends on your platform and browser.
- Okta Verify: Okta's app, with codes or push prompts.
- Email: a six-digit code from mongodb-account@mongodb.com, in a message titled Verify Your Identity. MongoDB lists it with a caution; it's only as safe as your mailbox.
When Atlas asks for a code
Atlas checks your second factor when you log in, and lets you choose which of your methods to use (MongoDB). It asks again before some account changes: removing an MFA method, changing your email address and deleting your account (MongoDB). The docs don't mention an option to remember a device.
If Atlas rejects your code
MongoDB's docs don't cover rejected authenticator codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Meanwhile, you can pick another method at the prompt. Other causes are in Authenticator code not working?
Changing phones
MongoDB doesn't document a transfer, but its remove and set-up steps cover it. While you still have the old phone or another method, click Delete next to the authenticator on Login and Security and verify with MFA. Then click Set up again and scan the new QR code with the new phone (MongoDB). If you have a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
At the login prompt, choose another method, such as email or a security key. Then remove the lost authenticator and set it up again.
If you've lost every method, MongoDB's only documented route is MongoDB Support (MongoDB). The docs don't say what proof it asks for or how long it takes, and they only describe opening cases from inside Atlas or the Support Portal, where any project member can raise one (MongoDB). In a team, a colleague in the same project may be able to open one for you. More in Lost the phone with your authenticator app?
Removing the authenticator
MFA is required when you sign in with Atlas credentials (MongoDB), so the docs offer no way to switch it off. You can remove one method with Delete, after verifying with MFA. Then open MongoDB in Novaz and tap Remove account.
