OneSignal 2FA: how to set up an authenticator app

OneSignal is the dashboard many app and web teams use to send push notifications, in-app messages, email and SMS. OneSignal calls its two-factor feature 2-step authentication (2FA), and it works with one method only: a 6-digit code from an authenticator app at each login (OneSignal). It's optional for you, unless an Organization Admin has made it required for the whole team.

The part to plan for is recovery. If you lose your phone and your recovery codes, OneSignal's support team wants a teammate with access to the account to confirm who you are before it resets anything. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the OneSignal steps come from OneSignal's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a OneSignal account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

OneSignal says any TOTP app works (OneSignal). The steps:

1. Log in to the OneSignal dashboard.
2. Click the Settings (gear) button at the bottom left of the sidebar, then Security under Account settings. The direct address is dashboard.onesignal.com/settings/security.
3. Under Authentication, find 2-Step Authentication and click Enable. (If 2FA was set up before, the button says Reconfigure.)
4. The Enable 2-Step Authentication screen shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the dashboard is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. To type the key instead, copy the Secret Key shown next to the QR code. In Novaz, tap +, then Enter key manually, put "OneSignal" in Service, your login email in Account, and paste the key into Setup key. See What is a 2FA setup key?
6. Type the current 6-digit code from Novaz into OneSignal to confirm.
7. Save the recovery codes OneSignal shows next (below).

OneSignal's codes are 6 digits and change every 30 seconds, so scanning and typing the key both work in Novaz. Use a personal iPhone you'll keep, not a shared test phone, as OneSignal advises. If you log in with an OAuth option such as Google, the same steps apply.

Save the 10 recovery codes

After setup, OneSignal shows 10 recovery codes, each good for one login. They're shown only once, so download or copy them right away and keep them in a password manager or another safe place. Setting up 2FA again with Reconfigure cancels the old set and gives you a new one (OneSignal).

OneSignal suggests picking an authenticator app with cloud backup or sync, so a new or lost phone doesn't lock you out. Novaz has iCloud backup (PRO), and a backup file you can export for free. Keep the recovery codes as well, somewhere other than that phone, in case it's lost and your Novaz backup is missing or old. More in 2FA backup codes.

When your team requires 2FA

An Organization Admin can turn on 2FA for everyone: Settings, Organization settings, Security, then Enable next to 2-step authentication, and Require 2-Step Authentication for all users (OneSignal). New invitees then set up 2FA before they get in, and current members without it are asked at their next login.

If your organization signs in through single sign-on (SSO), OneSignal hides its own 2FA controls on the organization Security page and leaves extra verification to your identity provider (OneSignal). In that case, your company's sign-in decides which app you use.

If OneSignal rejects your code

OneSignal's FAQ gives a checklist (OneSignal):

• Wait for the next code and try again.
• Make sure your phone sets its time automatically. On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
• Turn off ad blockers or privacy extensions, or allow *.onesignal.com in them.
• Hard refresh the page, or try another browser.

During setup, also check that the Secret Key went in correctly. More causes are in Authenticator code not working?

Changing phones

While you can still log in, go to Settings > Security, click Reconfigure, and scan the new QR code with Novaz on the new iPhone. Save the new recovery codes, since the old ones stop working. If you have a Novaz iCloud backup or backup file, you can restore OneSignal on the new iPhone instead and keep your current codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

With a recovery code: enter your email and password, choose to enter a recovery code on the 2FA screen, and type one. Then reconfigure 2FA right away. OneSignal warns that if you keep logging in with recovery codes, you'll run out and be locked out again (OneSignal).

Without recovery codes: email support@onesignal.com and copy (CC) a team member who has access to the same OneSignal account. That person has to confirm it's you before OneSignal's support team resets your 2FA. If nobody else on your team has access, support uses other checks, such as confirming billing or domain ownership. OneSignal doesn't say how long a reset takes.

Resetting your password doesn't help here: OneSignal says you still need a code from your app or a recovery code after a reset. More in Lost the phone with your authenticator app?

Turning 2FA off

Open Settings > Security under Account settings. When 2FA is on, the 2-Step Authentication section has the option to turn it off. You can't do this if your organization requires 2FA; ask your Organization Admin or OneSignal support (OneSignal). Afterwards, open the OneSignal account in Novaz and tap Remove account.

Official OneSignal help

• 2-step authentication
• Single Sign-On (SSO)
• Apps, Organizations, & Accounts
• Team members