OpenSea 2FA: how to set up an authenticator app

OpenSea, the NFT and token marketplace at opensea.io, puts its two-factor authentication in an unusual place: not at sign-in. If you join with an email address, OpenSea creates self-custodial EVM and Solana wallets tied to it, and you sign in with a 6-digit code it emails you, with no password (OpenSea). The second factor, a text message or an authenticator app, comes in when you use that wallet: buying an item, sending funds or exporting your private key. Both checks run on Privy, an outside provider (OpenSea).

If you sign in with your own wallet, such as MetaMask, none of this applies. OpenSea can't reach that wallet's settings, so its security belongs to the wallet's maker (OpenSea).

The steps below use Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the OpenSea steps come from OpenSea's own Help Center articles and their screenshots, linked below, which we read on October 20, 2026. We haven't tested them on an OpenSea account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

App or text message?

OpenSea offers SMS and Authenticator. Its safety article favors an app such as Google Authenticator and suggests avoiding SMS codes where possible, since they can be attacked (OpenSea). A phone number can also serve SMS codes for only one OpenSea account (OpenSea). See authenticator app vs SMS.

OpenSea prompts you to choose a method the first time you buy with your email wallet, but you can enroll earlier from your settings (OpenSea).

Turn on 2FA with an authenticator app

On the website (OpenSea, OpenSea):

1. Sign in at opensea.io with your email address and the emailed code.
2. Open Settings and choose Embedded Wallet. The MFA Methods box lists SMS and Authenticator.
3. Select Enroll next to Authenticator and follow the prompts.

In the mobile app, the same option is under Settings > Security > Multi-Factor Authentication (OpenSea).

OpenSea's help doesn't show the enrollment screens, so it doesn't say whether you get a QR code, a typed key or both, or how often codes change. Add whichever you see to Novaz:

• QR code: tap +, then Scan QR code. Prefer this, because the code carries all the settings. If the QR code is in the OpenSea app on this same iPhone, take a screenshot and use Choose a photo instead, or enroll from a computer. See scanning a QR code on the same iPhone.
• Key: tap +, then Enter key manually, and fill in Service (OpenSea), Account (your email) and Setup key. See What is a 2FA setup key?

Then enter the current Novaz code in OpenSea to finish.

When OpenSea asks for the code

Before a wallet action such as a purchase, a transfer or a key export, a window titled MFA required asks for six digits (OpenSea). A successful check lasts 20 minutes; after that, the next wallet action asks again (OpenSea). Signing in still uses only the emailed code.

If OpenSea rejects your code

OpenSea's help covers codes that don't arrive (check spam, use Resend code, check your connection), not codes that are refused (OpenSea). Novaz makes codes on the phone itself, so a refused code usually points to the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns when the clock is 15 seconds or more off. More in Authenticator code not working?

No backup codes, so add a second method

OpenSea's help doesn't mention backup or recovery codes. For a lost authenticator, it points to your authenticator app's own backup of the QR code or key (OpenSea). In Novaz, that's iCloud backup (PRO) or a backup file made with Export to file…. Without either, its keys stay only on your iPhone.

So if you use Novaz, enroll SMS too. OpenSea lets you keep several methods, so losing one leaves you another (OpenSea).

Changing phones

To replace a method, OpenSea has you enroll the new one first: it sends a code to your current method, then you add the new phone or app. After the confirmation, select Unenroll on the old one (OpenSea). The help doesn't say whether two authenticator apps can be enrolled at once, or whether you can unenroll your last method. Keep the old iPhone until the new one works. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use your second method if you set one up. OpenSea names one more route to your funds and NFTs: a private key you exported earlier, imported into another wallet such as MetaMask (OpenSea). Exporting asks for a code when MFA is on, so do it while you still have one. OpenSea can't see or recover that key, so keep it somewhere safe and never share it.

The Help Center doesn't describe support resetting MFA, or any timeline. To ask, use the Support button on opensea.io and give your email address, wallet address and a description of the problem (OpenSea). Protect your email account as well: OpenSea warns that losing it means losing the wallet (OpenSea). See Lost the phone with your authenticator app?

Official OpenSea help

• How do I change or add multiple two-factor authentication methods?
• How do I export my private key?
• How do I manage settings on the OpenSea app?
• Create your account with an email
• Purchase your first NFT
• How can I stay safe and protect my NFTs?
• How do I reset my login information?
• How can I contact OpenSea?