ngrok 2FA: how to set up an authenticator app

Your ngrok user is what you sign in with at dashboard.ngrok.com, where your authtokens, API keys, domains and endpoints live. ngrok calls its two-factor option multi-factor authentication (MFA), and it has only one kind of second factor: time-based one-time codes (TOTP) from an authenticator app. There's no text-message option (ngrok). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the ngrok steps come from ngrok's own documentation and its engineering blog, linked below, which we read on October 21, 2026. We haven't tested them on an ngrok account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Is MFA required?

For your own user, it's optional. An ngrok account (the organization or team your user belongs to) can be set up to require MFA for every user in it (ngrok). Because one ngrok user can belong to several accounts, a work account that requires MFA can mean you need it even if your personal account doesn't.

You can also sign in with GitHub, Google or your company's single sign-on. ngrok's page doesn't say how its own MFA works alongside those sign-in methods.

Turn on MFA with an authenticator app

New users are asked to set up MFA during signup, on a screen with a QR code (ngrok). If you skipped that or signed up earlier, turn it on from the dashboard:

1. Sign in at dashboard.ngrok.com.
2. Select your username in the upper-left corner, then User Settings.
3. Scroll down to Multi Factor Authentication and select Enable. In ngrok's own screenshot, the button reads Enable TOTP.
4. ngrok shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the dashboard is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. If ngrok asks for a code to confirm, type the one Novaz shows.
6. Save the recovery codes ngrok gives you. You can copy them or download them.

ngrok's page only shows the QR code. It doesn't mention a text key you could type instead, or say how many digits its codes have. Scanning is the reliable route, because the QR code carries the code settings to Novaz. If you do find a key and type it with Enter key manually, Novaz makes 6-digit codes every 30 seconds.

After setup, ngrok asks for a code from your app every time you sign in to the dashboard (ngrok).

Your recovery codes are your backup

Recovery codes get you in when you can't reach your authenticator. Unless you've turned on iCloud backup or exported a backup file in Novaz, its keys exist only on your iPhone, so these codes are your spare way in. Keep them off the phone, in a password manager or on paper.

If you've used several codes or think someone has seen them, go back to Multi Factor Authentication in User Settings and generate new ones. The screenshot shows this button as Regenerate codes (ngrok). ngrok doesn't say how many codes you get, or whether the old ones stop working when you make new ones. More in 2FA backup codes.

If ngrok rejects your code

ngrok's documentation has no advice for codes that don't work. The most common cause is a clock that's off. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

ngrok doesn't describe moving MFA to a new phone, but its settings let you switch MFA off and on. While you still have the old phone, sign in, select Disable under Multi Factor Authentication, then Enable it again and scan the new QR code with the new phone. If you use Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead and skip this. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with one of your recovery codes, then set up MFA again on a new phone.

If you have no recovery codes left, ngrok's documentation says to email support@ngrok.com from the address you use to sign in to ngrok (ngrok). There's no text-message fallback by design. When ngrok launched MFA in 2023, its engineering blog explained that it chose to have support verify people rather than send codes by SMS, which can be hijacked. The post describes that kind of check as usually relying on billing details or a name matched against a government ID (ngrok). The current documentation doesn't list what proof support asks for or how long it takes.

More in Lost the phone with your authenticator app?

Turning MFA off

In User Settings, under Multi Factor Authentication, select Disable. The screenshot labels it Disable TOTP (ngrok). ngrok doesn't say what happens if an account you belong to requires MFA. Then open the ngrok entry in Novaz and tap Remove account.

Official ngrok help

• Users (ngrok documentation; sections "MFA", "Recovery codes", "Manage MFA settings" and "Lost access or recovery")
• MFA for your production infrastructure running on ngrok (ngrok blog, October 18, 2023)