ChatGPT and OpenAI 2FA: how to set up an authenticator app

One OpenAI account covers ChatGPT and the API Platform, and multi-factor authentication (MFA) "applies across OpenAI services" (OpenAI). OpenAI offers several methods: an authenticator app, push notifications on a trusted device, codes by SMS or WhatsApp, and passkeys. Email isn't an MFA option. Which methods you see can depend on your device, country, plan and how you created the account. This guide sets up an authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the OpenAI steps come from OpenAI's own help pages, linked below, which we read on October 11, 2026. We haven't tested them on an OpenAI account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Do you have to turn it on?

Usually not. But if you sign in with an email and password, OpenAI says you "must set up MFA" before using Codex cloud (OpenAI). If you sign in with Google, Microsoft or Apple, Codex doesn't require it, and OpenAI suggests turning on MFA with that provider. If you sign in through your company's SSO, your organization decides. OpenAI says MFA can't currently be enforced for a ChatGPT workspace or an API organization.

Turn on MFA with an authenticator app

OpenAI's help describes these steps (OpenAI):

1. In ChatGPT, open Settings, then Security and login.
2. Under Multi-factor authentication (MFA), choose the authenticator app method.
3. OpenAI shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. Type the one-time code from Novaz to finish.

MFA starts at your next sign-in. Turning it on doesn't sign out other devices, so use Log out of all devices on the same page if you want that. OpenAI says it can take up to 30 minutes.

OpenAI's help doesn't describe backup codes for standard MFA. Your fallback is a second method, so consider adding a passkey too.

Signing in afterwards

If you've set up more than one method, OpenAI "defaults to the most secure option first", and you can still choose any of the others.

If your code is rejected

Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

• Use another MFA method you set up, such as a passkey or push on another device.
• If you have none, contact OpenAI Support. OpenAI says verifying you "can take a few days". You then get a one-time email recovery sign-in, and you must add a backup method or turn MFA off. This recovery works only once (OpenAI).
• If you turned on Advanced Account Security, Support can't remove it. Only your recovery keys work, and the account unlocks 48 hours after you enter one (OpenAI).

More in Lost the phone with your authenticator app?

Official OpenAI help

• Managing multi-factor authentication
• Advanced Account Security
• Codex authentication