n8n 2FA: how to set up an authenticator app

n8n is a workflow automation tool. Your n8n account is the user you sign in with on an instance, either an n8n Cloud workspace or a server you run yourself. Two-factor authentication (2FA) is set per user, and the only method is a code from an authenticator app (n8n). It's optional unless whoever runs your instance turns on enforcement. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the n8n steps come from n8n's own documentation and release notes, linked below, and from the screen labels in n8n's open-source code on GitHub. Version 2.44, from October 13, 2026, redesigned the setup window, and the documentation still shows older labels. We read everything on October 20, 2026. We haven't tested the steps on an n8n account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

• Enforced 2FA: on n8n Cloud Enterprise and self-hosted Business or Enterprise, an admin can turn on Enforce two-factor authentication under Settings > Security. You then have to set up 2FA at your next sign-in before you can keep working (n8n).
• Single sign-on: enforcement skips people who sign in through SAML or OIDC, and n8n hides the 2FA option from them, except for the instance owner (n8n, n8n source).
• No 2FA option on a self-hosted instance: the admin may have turned it off for everyone with N8N_MFA_ENABLED (n8n).

Turn on 2FA with an authenticator app

With the 2.44 labels (n8n, n8n source):

1. In n8n, go to Settings > Personal.
2. Under Security, next to Two-factor authentication (2FA), select Enable 2FA.
3. The Set up authenticator app window shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. Can't scan it? n8n prints a key under the QR code, and Copy key copies it. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
5. Type the 6-digit code from Novaz into 2. Enter the 6-digit code from the app and select Continue.
6. On Save your recovery codes, select Download (n8n saves a text file) or Copy. Enable 2FA stays unavailable until you do one of the two.
7. Select Enable 2FA.

n8n checks the step 5 code again when you select Enable 2FA, so don't linger on the recovery codes. After a few minutes it fails with MFA token expired. Close the modal and enable MFA again, and you start over (n8n source).

Versions before 2.44 title the window Setup Authenticator app [1/2] and end with I have downloaded my recovery codes (n8n source). Releases reach instances gradually (n8n), so you may see either set.

Your recovery codes

n8n gives you 10 recovery codes. Each works once (n8n source). There's no button to make new ones: you get a fresh set only by turning 2FA off and on again.

Unless you've made an iCloud backup or a backup file in Novaz, its keys exist only on your iPhone, so these codes are your way back in. Store them away from the phone. See 2FA backup codes.

When n8n asks for a code

n8n asks for a code whenever you sign in with your email and password, on a screen titled Two-factor authentication. It also asks when you change your password or email address, and when you turn 2FA off (n8n source).

If n8n rejects your code

n8n's documentation has no advice for this. At sign-in, n8n says the code is invalid and offers Enter a recovery code. In other code prompts, too many wrong tries make you wait a few minutes (n8n source). Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. On a self-hosted instance, check the server's clock too. More in Authenticator code not working?

Changing phones

n8n's documentation doesn't cover this. While you still have the old phone, select Disable 2FA in Settings > Personal, confirm with a code, then select Enable 2FA and scan the new QR code with the new phone. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

• You have recovery codes: on the sign-in code screen, select Enter a recovery code, type one and select Verify (n8n source). Signing in uses up that code, and turning 2FA off takes a code too, so you need two to reset 2FA onto a new phone.
• Self-hosted, no codes: someone with access to the server can run n8n mfa:disable --email= followed by your email address. You then sign in with your password and set 2FA up again (n8n).
• n8n Cloud, no codes: the documentation doesn't describe a reset. Its email support, help@n8n.io, covers admin issues on every Cloud plan (n8n). n8n doesn't say what proof it asks for or how long a reset takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Go to Settings > Personal and select Disable 2FA. In the Disable 2FA? window, type a code from Novaz or a recovery code into 2FA code or recovery code, then select Disable 2FA (n8n source). If your instance enforces 2FA, n8n asks you to set it up again when you next sign in (n8n).

Official n8n help

• Require two-factor auth
• Manage security policies
• User management and 2FA
• Use the command line
• Where to get help
• Release notes
• n8n source code on GitHub, version 2.44.0: n8n-io/n8n