myGov 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
myGov is the Australian Government account that links services like the Australian Taxation Office (ATO) and the National Disability Insurance Scheme (NDIS). You can sign in with a Digital ID (myID), a passkey, or your myGov username and password. If you use the username and password, myGov also needs a multifactor option on top: a code by SMS, a code from an authenticator, or the old myGov Code Generator app (myGov).
The detail that matters most: myGov says some authenticators can't be used because they don't meet the SHA-256 standard, and it names Microsoft Authenticator as one of them (myGov). This guide uses Authenticator App - Novaz on iPhone, which handles SHA-256 when you scan the QR code. Other apps that support SHA-256 work the same way.
How we checked this guide: the myGov steps come from myGov's own help pages on my.gov.au, linked below, which we read on October 21, 2026. We haven't tested them on a myGov account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Do you need it?
An authenticator isn't required, but without any multifactor option you're left with secret questions, which myGov calls the least secure choice. To use the ATO or the NDIS through myGov, you need a multifactor option other than secret questions (myGov).
You can only have one authenticator on a myGov account. If the myGov Code Generator app is connected, adding an authenticator replaces it. That app has left the app stores and is being retired (myGov).
Turn on 2FA with an authenticator app
Use the myGov website, on a computer if you can, so the QR code is on another screen (myGov):
- Sign in to myGov at my.gov.au.
- From the My account menu, select Account settings.
- Under Sign in settings, go to Authenticator and select Manage.
- Select Add, then verify your identity.
- myGov shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code from Novaz into myGov to finish.
Don't type the setup key into Novaz. myGov itself warns that some authenticators may not work with the key. In Novaz, Enter key manually always makes SHA-1 codes, and myGov requires SHA-256, so they won't match. The QR code carries the right settings. See What is a 2FA setup key?
The myGov app's path (Sign in settings > Authenticator > Add authenticator) offers only Open authenticator app or Use set up key, with no QR code in its steps. With Novaz, use the website instead.
Signing in afterwards
After your username and password, myGov asks for the code from Novaz. In the myGov app, choose Sign in, then myGov details first (myGov). The pages describe this for every username-and-password sign-in and don't mention trusted devices.
Backup codes
myGov's help pages don't mention backup codes. Your fallbacks are other sign-in options: a Digital ID, a passkey or Codes by SMS. Novaz's keys stay on your iPhone unless you've made an iCloud backup or a backup file, so set one of these up now.
If myGov rejects your code
myGov says the device running your authenticator must show the correct local time (myGov). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
If myGov won't accept the code that finishes setup and you typed the key, that's the likely cause. Open the myGov entry in Novaz, tap Remove account, start again in myGov and scan the QR code. More causes are in Authenticator code not working?
Changing phones
myGov has a Replace option. Sign in, open Account settings, go to Authenticator under Sign in settings, select Manage, then Replace. Verify your identity, scan the new QR code and enter a code (myGov). If you use Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. Without one, replace it while the old iPhone still works. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
myGov's sign-in help has no section for a lost authenticator. For a missing code, it suggests signing in another way: with your Digital ID if it's connected, a passkey, or the myGov app (myGov). If you can't use any multifactor option, myGov lets you choose secret questions and answers instead (myGov).
If none of that works, you can recover the account with myID. This needs a myID with Strong identity strength, and your name, date of birth and email address in myGov must match it. On the sign-in page, choose the option for not being able to use your sign-in option, then Continue with Digital ID (myGov). Without myID, myGov says you'll need a new account and to relink your services. The myGov helpdesk, on 132 307 (option 1), can release your email address for the new account (myGov). myGov doesn't say how long any of this takes.
More in Lost the phone with your authenticator app?
Turning it off
In Account settings, under Sign in settings, go to Authenticator, select Manage, then Remove, and verify your identity. You need another strong option first, such as a Digital ID, a passkey or Codes by SMS. Without one, you can't remove it. myGov also warns that the ATO and the NDIS may unlink from your account if you remove the authenticator without a strong option (myGov). Afterwards, delete the myGov entry in Novaz with Remove account.
