Open Collective 2FA: how to set up an authenticator app

Open Collective is where many open source projects and community groups keep a public budget, collect donations and pay expenses. Most people never set a password there: by default you sign in by clicking a link Open Collective emails you, and you can add a password later if you want one (Open Collective). Two-factor authentication (2FA) adds a 6-digit code on top of that. You can protect it with an authenticator app, a YubiKey or a fingerprint sensor (Open Collective). This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Open Collective steps come from Open Collective's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on an Open Collective account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

When you have to turn it on

For a personal account, 2FA is optional. Open Collective strongly suggests it if you handle money for a community (Open Collective). It stops being optional in two cases:

• Your collective, organization or fiscal host requires it. Admins can tick All admins must have 2FA under Dashboard > Settings > Security. After that, every admin is blocked from admin pages and tasks until they turn on 2FA for their own profile. Projects and events follow the same setting (Open Collective, Open Collective).
• Your fiscal host turns on 2FA for payouts. Then every admin or accountant who pays expenses needs 2FA on their own account first (Open Collective).

Turn on 2FA with an authenticator app

Open Collective's current documentation describes these steps (Open Collective):

1. Sign in to Open Collective and go to Dashboard > Settings > Security.
2. Choose to set up two-factor authentication with an authenticator app. Open Collective shows a QR code.
3. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. Type the 6-digit code from Novaz into the box on the page to finish.
5. Save the recovery codes Open Collective gives you (see below).

The current page doesn't name its buttons. An older version of the documentation, last updated in January 2024, called the final button Verify and see recovery codes (Open Collective). Neither page says whether Open Collective offers a text key instead of the QR code. If you see one, you can add it in Novaz with + > Enter key manually, typing it as the Setup key. See What is a 2FA setup key?

After setup, keep the Open Collective entry in Novaz. The documentation warns you not to delete it from your authenticator app.

Save your recovery codes

Open Collective gives you recovery codes during setup, for the day you can't use your authenticator app. Each code works once, according to the older documentation (Open Collective). The docs don't say how to get a new set.

Without a Novaz iCloud backup or backup file, the key lives only on your iPhone, so these codes are what gets you back in if that phone is gone. Store them away from the phone, for example in a password manager. More in 2FA backup codes.

When Open Collective asks for a code

• Signing in. You enter a code from Novaz each time you log in (Open Collective). If you use the email link, the code comes after you click it (Open Collective). A sign-in keeps you logged in on that device for 30 days (Open Collective).
• Sensitive actions. Changing your organization's platform subscription always asks for a code. So do connecting a bank account or Wise, and paying expenses when your fiscal host requires 2FA for payouts (Open Collective).
• Paying expenses as a host. The first payment in a session asks for a code. After that you can keep paying until the total passes a limit set under Settings > Security in the host dashboard, $10,000 unless changed, and then you're asked again. Each admin has their own limit (Open Collective).

If Open Collective rejects your code

Open Collective's documentation has no advice for a refused code. Check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

The documentation doesn't describe moving 2FA to a new phone, or turning it off. Look in Dashboard > Settings > Security while you still have the old phone. With a Novaz iCloud backup or backup file, you can restore Open Collective on the new iPhone; without one, you'll need to add it to the new phone with a fresh QR code. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use one of your recovery codes. If you have none left, contact Open Collective's support team through opencollective.com/help. It warns that it may ask for substantial proof that the account is yours before it restores access, but doesn't list what proof it accepts or how long this takes (Open Collective, Open Collective). More in Lost the phone with your authenticator app?

Official Open Collective help

• Two Factor Authentication
• Logging into your Account
• Security for Collectives
• Fiscal Host Security
• Two-factor Authentication (older documentation)