Odoo 2FA: how to set up an authenticator app

Odoo is business software: a company's sales, accounting, inventory and HR apps share one Odoo database. Two-factor authentication (2FA) is a setting in your user preferences inside that database, and the only second step Odoo's documentation describes is a code from an authenticator app (Odoo). Before you turn it on, know who your Odoo administrator is: the docs mention no backup codes, and a lost authenticator has to be reset by an admin. Your company may also require 2FA.

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Odoo steps come from Odoo's own documentation, linked below, which we read on October 20, 2026. We haven't tested them on an Odoo database, so a label may differ slightly, and Odoo's labels change between versions. The Novaz steps are checked against the app, version 1.0.5.

Three places Odoo offers 2FA

• Your user in a company's Odoo database, which is what employees sign in to. Steps below.
• A customer portal. If a business gave you portal access, its Connection & Security page shows your 2FA status with an Enable two-factor authentication link (Odoo).
• Your Odoo.com account, used to create and manage databases. Turn it on from the Connection & Security page at odoo.com/my/security; Odoo says the steps are similar (Odoo).

Turn on 2FA with an authenticator app

Odoo's current documentation (version 20.0) gives these steps (Odoo):

1. Sign in to your Odoo database, click your profile avatar in the upper-right corner, and choose My Preferences.
2. Open the Security tab and click Enable 2FA.
3. In the Access Control window, type your Odoo password and click Confirm Password.
4. A Two-Factor Authentication Activation window shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If Odoo is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, click Cannot scan it? for the key as text. In Novaz, tap +, then Enter key manually, name the entry under Service, and type the key under Setup key. See What is a 2FA setup key?
6. Type the code from Novaz in the Verification code field and click Enable Two-Factor Authentication.

The docs don't give the code length or interval, so scan the QR code if you can: it passes those settings to Novaz, while a typed key always gets 6 digits every 30 seconds.

If your screens look different, your database may run an older version. The docs for Odoo 17 and 18 send you to My Profile and the Account Security tab, where you slide the Two-Factor Authentication toggle on. The password window there is called Security Control, and the last step is the Verification Code field and Activate (Odoo).

When Odoo asks for a code

After your username and password, Odoo opens a Two-factor Authentication page: type the code in Authentication Code and click Log in (Odoo). The docs don't mention a trusted-device option.

If Odoo asks for codes often, your admin may have set a timeout. With the auth_timeout module, a user group's Timeouts tab can require 2FA again after inactivity (Screen lock with two-factor authentication) or after a fixed session length (Logout with two-factor authentication) (Odoo).

If your company requires 2FA

Admins turn it on in the Settings app, Permissions section, with Enforce two-factor authentication, for Employees only or All users (which adds portal users) (Odoo). On Odoo 17 and 18, the docs say to install the 2FA by mail module first (Odoo). For a single portal user, the Invite to use 2FA button on the Security tab of their contact form sends an invitation (Odoo). With the Australian fiscal localization, 2FA can't be deactivated, because the Australian government requires it (Odoo).

If Odoo rejects your code

Odoo's docs have no troubleshooting advice for codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

Odoo's docs don't describe moving 2FA to a new phone. With a Novaz iCloud backup or backup file, you restore your accounts on the new iPhone and the codes keep working (details). Without one: on a portal, use Disable two-factor authentication on the Connection & Security page, then set it up again on the new phone. For a company database, the current docs don't describe turning 2FA off yourself, so ask your administrator before you give up the old phone.

If you lose your authenticator

Odoo's docs mention no backup codes to fall back on, and they're direct about the fix: "an administrator must deactivate 2FA on the account before the user can log in" (Odoo). The docs don't say what proof an admin needs, how long it takes, or what to do if you're the only administrator. Once it's deactivated, sign in and set up 2FA again.

For your Odoo.com account, the docs don't describe a recovery route. Odoo's support contact page is odoo.com/help. See also Lost the phone with your authenticator app?

Official Odoo help

• Two-factor authentication (Odoo 20.0 documentation)
• Two-factor authentication (Odoo 18.0 documentation)
• Odoo.com account
• Access rights
• Updating portal info
• Australia (fiscal localization)