OSF (Open Science Framework) 2FA: how to set up an authenticator app

OSF, the Open Science Framework run by the Center for Open Science, is where many researchers keep project files, preregistrations and preprints. Your account is still your way in even as OSF changes: it stops new projects on November 16, 2026, and turns every project read-only on February 19, 2027, while registrations and preprints carry on as before (OSF). Private projects stay readable to the people who already have access, so you'll keep signing in.

Two-factor authentication (2FA) on OSF is optional, and an authenticator app is the only method OSF's help describes (OSF). There are no backup codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the OSF steps come from OSF's own help pages and the source code the Center for Open Science publishes on GitHub, linked below, which we read on October 20, 2026. We haven't tested them on an OSF account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: there's nothing to fall back on

OSF gives you no recovery codes and no second method. The settings screen itself warns that without your phone you won't be able to sign in (OSF). The way back in is OSF Support and a copy of your photo ID (see below).

Without a Novaz iCloud backup or backup file, OSF's key exists only on your iPhone. For another fallback, save the setup key OSF shows you in a password manager during setup. That key can produce your codes on any device, so keep it somewhere only you can open.

Turn on 2FA with an authenticator app

OSF's help describes these steps (OSF):

1. Sign in to OSF. Open Settings in the left sidebar, then choose Account Settings.
2. Scroll to the Two-Factor Authentication section and click Configure.
3. Read the window that opens, then click Configure again. Nothing is on yet: the next steps appear in the same section.
4. OSF shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. If you'd rather type it, OSF also shows a key. The help calls it a security key; the screen calls it a secret key. In Novaz, tap +, then Enter key manually. Type OSF as the Service, your OSF email address as the Account, and the key as the Setup key. See What is a 2FA setup key?
6. Type the code from Novaz into the box under the QR code and click Enable.

OSF's help doesn't say how long its codes are. Its published source code uses ordinary 6-digit codes that change every 30 seconds, so a typed key works as well as a scan (OSF). The key is long, so scanning saves typing.

Signing in afterwards

The next time you sign in, OSF asks for a code from your app before letting you in (OSF). The sign-in page labels the field One-time password (6-digit), with a Verify button (OSF). OSF's help doesn't say whether signing in with ORCID or through your institution also asks for the code.

If OSF rejects your code

During setup, OSF asks you to enter the code again if verification fails (OSF). At sign-in, it tells you the one-time password was incorrect (OSF). Its help offers nothing more.

The usual cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

OSF's help doesn't cover moving 2FA to a new phone, but the two steps it does document get you there while the old phone still works: disable 2FA, then set it up again on the new phone. OSF makes a new key each time you configure it (OSF), so the old entry stops working. Remove it from the old phone's Novaz with Remove account.

If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Without your phone, you can't turn 2FA off yourself. OSF's FAQ says to email support@osf.io, and that Support will first check who you are (OSF). The simplest proof, it says, is a photo or scan of a picture ID, such as a school ID or a driver's license. Black out sensitive details like the ID number and your date of birth before you send it. OSF doesn't say how long this takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Go back to Settings > Account Settings, scroll to Two-Factor Authentication and click Disable. OSF asks you to confirm; click Disable again (OSF). Then remove the OSF entry from Novaz, since its codes no longer do anything.

Official OSF help

• Profile and Account: Enable or Disable Two-Factor Authentication
• Profile and Account: FAQs (Broken or lost phone?)
• OSF Projects Transition
• OSF source code: two-factor settings (osf.io on GitHub)
• OSF source code: settings screen text (ember-osf-web on GitHub)
• OSF source code: sign-in screen text (osf-cas on GitHub)