Skip to content
Novaz AuthenticatorGET

Okta 2FA: how to set up an authenticator app for your work sign-in

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. First, check what your admin allows
  2. Set up Google Authenticator with Novaz
  3. When Okta asks for a code
  4. If Okta rejects your code
  5. Changing phones or removing it
  6. If you lose your authenticator
  7. Official Okta help

If your company uses Okta, it's where you sign in to your work apps, at an address like org-name.okta.com (Okta). Your company's IT admin decides whether you need a second step, how often you're asked, and which methods you can pick. When the admin allows an authenticator app, it appears as Google Authenticator. This guide uses Authenticator App - Novaz on iPhone with that option. Any authenticator app works the same way.

How we checked this guide: the Okta steps come from Okta's own help pages for end users and admins, linked below, which we read on October 20, 2026. We haven't tested them on an Okta account, and your company's settings can change what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, check what your admin allows

Okta offers many methods, including Okta Verify, Google Authenticator, phone, email and passkeys, and an admin has to turn each one on (Okta). You can only set up the ones your company's enrollment policy assigns to you (Okta). No Google Authenticator in your list means no Novaz for Okta. Ask your IT department, which is where Okta's end-user help sends you (Okta).

Okta Verify is Okta's own app. It can confirm a sign-in with a push notification or your phone's biometrics (Okta). Novaz can't approve push notifications or stand in for Okta Verify. If your company requires it, use Okta Verify.

Okta's pages name only Google Authenticator for this option, and Okta says its support can't help with Microsoft Authenticator (Okta). The option uses standard time-based codes (TOTP), the kind Novaz makes (Okta). If something goes wrong, ask your IT team, not Okta.

Set up Google Authenticator with Novaz

You can start from your settings at any time (Okta):

  1. Sign in to Okta, click your name on the dashboard and select My Settings (on some dashboards, Settings). Or go to your Okta address followed by /account-settings/home.
  2. From the Settings menu, select Security methods.
  3. Find Google Authenticator and click Set up another. Okta may ask you to verify your identity first (Okta).
  4. Follow the Set up security methods page. If Okta asks for your device type, choose iPhone, then Next.
  5. Okta shows a QR code. Don't click Next yet. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. If you can't scan it, click Can't scan and note the string of letters and numbers. In Novaz, tap +, then Enter key manually. Enter your company name as the Service, your Okta username as the Account, and the string as the Setup key. See What is a 2FA setup key?
  7. Click Next, type the code from Novaz in Enter Code, and click Verify.

Steps 4 to 7 follow Okta's admin page for this option. It also covers setup during sign-in: if your company requires a second step, a Setup security authenticators page may appear after your password. Click Set up and continue the same way (Okta).

Okta's developer reference shows 6-digit codes on a 30-second cycle from a base32 key, which matches what Novaz uses when you type a key (Okta).

When Okta asks for a code

Your company's policies decide. If your company offers Keep me signed in and you pick it, Okta stops asking for a second step on that device until the time your admin set runs out or you clear your cookies. To undo it, open your settings and click Sign out under End all sessions, which signs you out everywhere (Okta).

If Okta rejects your code

Don't keep guessing. Five wrong codes within five minutes block sign-in until that period passes (Okta). Okta's page for its older Classic Engine is stricter: five failed tries lock the account until an admin resets it (Okta).

Okta allows a clock difference of up to two minutes (Okta). Wait for a fresh code and check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones or removing it

Okta's end-user pages don't mention backup codes, and without a Novaz backup your key exists only on your iPhone, so set up a second method too if your company offers one.

Before you give up the old phone, go to Security methods, select Remove next to Google Authenticator, then set it up again on the new one (Okta). Company policy can block removing a method (Okta). If it does, ask IT. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone. To stop using Novaz for Okta, remove it the same way, then tap Remove account in Novaz.

If you lose your authenticator

If you have another method, sign in with it and set up Google Authenticator again. Otherwise, contact your IT department or help desk. An admin can reset your authenticators so you can set them up again (Okta).

Some companies use temporary access codes. An admin checks who you are, gives you a code over a separate channel such as a phone call, and the code expires after a time your company sets (Okta). Okta doesn't say how long recovery takes; your company handles it. More in Lost the phone with your authenticator app?

Official Okta help

More guides: Security, identity and VPN