Skip to content
Novaz AuthenticatorGET

Netlify 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Your recovery codes are the backup
  3. If your team requires 2FA
  4. When Netlify asks for a code
  5. If Netlify rejects your code
  6. New iPhone or turning it off
  7. If you lose your authenticator
  8. Official Netlify help

Your Netlify user ID is the login behind your sites, deploys and team settings, whether you sign in with email, Google, GitHub, GitLab or Bitbucket (Netlify). Netlify's built-in two-factor authentication (2FA) has one method only. Its setup screen says it "requires a one-time password authenticator app," and the user settings page offers nothing else (Netlify). It's optional unless an Owner of one of your teams enforces it.

We use Authenticator App - Novaz on iPhone in the steps below. Any authenticator app works the same way.

How we checked this guide: the Netlify steps come from Netlify's own docs, support page and blog, linked below, which we read on October 21, 2026. We haven't tested them on a Netlify account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

These steps follow Netlify's user settings docs and the screenshot on that page (Netlify):

  1. In the Netlify app, select your avatar (its screen-reader label is User), then User settings.
  2. Go to Security > Two-factor authentication and select Enable two-factor authentication. Signed in already? app.netlify.com/user/security opens that tab (Netlify).
  3. On Configure two-factor authentication, a QR code sits next to 1) Scan the QR code. In Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and use Choose a photo instead (how).
  4. Can't scan? Copy the key under Manual entry. In Novaz, tap +, then Enter key manually, type Netlify as the Service and paste the key into Setup key (more on setup keys).
  5. Under 2) Enter your authentication code, type the 6-digit code from Novaz into Authentication code, then select Next: Recovery codes.
  6. Copy or print the recovery codes and select Finished! I saved my recovery codes.

The docs give 6 digits but no interval or key length, so scanning the QR code is the safer choice.

Your recovery codes are the backup

Netlify shows the recovery codes once, during setup, and each works a single time. The docs don't say how many you get (Netlify). Unless you've turned on iCloud backup or exported a backup file in Novaz, its keys exist only on your iPhone, so if that phone is gone, these codes are your way back in. Store them off the phone, in a password manager on another device or on paper. See 2FA backup codes.

The docs don't mention making a fresh set. In a 2022 reply on Netlify's support forum, a Netlify support engineer said the only way he knew was to turn 2FA off and on again (Netlify Support Forums).

If your team requires 2FA

On the Pro plan or higher, an Owner can set the 2FA policy to None (default), Encouraged (a banner for members without 2FA) or Enforced (no access to team resources until they set it up). A team's setting is under Team settings > Access > Two-factor authentication. An organization's is under Organization overview > Access & security, and it overrides each team's (Netlify).

It applies to every team role except Git Contributors, who can't log in to Netlify. Companies that sign you in through SSO may require 2FA in their identity provider instead, where Netlify recommends FIDO2 security keys (Netlify).

When Netlify asks for a code

Netlify's security scorecard docs say that once 2FA is on, you use it every time you log in (Netlify). A recovery code can replace the app code. Netlify doesn't document a way to skip the code on a trusted browser.

If Netlify rejects your code

Netlify's docs don't cover this. Check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If setup won't accept the code, select Cancel and start again by scanning the QR code. Other causes: Authenticator code not working?

New iPhone or turning it off

To turn 2FA off, go back to User settings > Security > Two-factor authentication, select Disable two-factor authentication and enter an app code or a recovery code (Netlify). If a team enforces 2FA, you lose access to it until you turn it back on. Then open Netlify in Novaz and tap Remove account.

Netlify doesn't describe moving 2FA to a new phone. The documented route is to disable and re-enable it, scanning the new QR code on the new iPhone, while the old phone still gives codes. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead; see How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with a recovery code. To set up a new phone, you'll then need another unused one, since turning 2FA off asks for a code.

With no codes left, contact Netlify Support. Netlify's docs say login problems need a person, not its AI assistant, and that Support covers every plan, Free included (Netlify). On the support page, under What kind of help do you need?, choose Can't log in (password, 2FA, or verification email) and enter the email on your Netlify account (Netlify). If the form fails, the page says to email support@netlify.com from that address. Netlify doesn't say what proof it asks for or how long a reset takes. See also Lost the phone with your authenticator app?

Official Netlify help

More guides: Hosting and cloud