Optimizely 2FA: how to set up an authenticator app

Optimizely has two sign-in systems, and which one you have decides how two-factor authentication (2FA) works. If you sign in to Optimizely Web Experimentation, Feature Experimentation, Personalization or Performance Edge with a classic Optimizely username and password, you can turn on what Optimizely calls individual 2-step verification yourself, with any authenticator app. If your organization has moved to Opti ID, Optimizely's newer central login, that personal setting no longer applies: users are managed in Opti ID instead (Optimizely).

This guide covers the classic setting, with a note on Opti ID at the end. We use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Optimizely steps come from Optimizely's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on an Optimizely account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2-step verification with an authenticator app

Optimizely's documentation describes these steps (Optimizely):

1. Sign in to Optimizely Experimentation and open your Profile.
2. Under 2-Step Verification, click Enable.
3. Enter your Optimizely password and click Next.
4. Optimizely shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Type the code from Novaz into the field and click Next.
6. A window with your backup codes appears. Save them before you close it.

The documentation names Google Authenticator, Duo Mobile and Microsoft Authenticator as examples and says codes change every 30 seconds. It doesn't mention a text key, so plan to scan the QR code. If Optimizely does show a key, tap +, then Enter key manually in Novaz, and paste it as the Setup key (what a setup key is).

If your admin requires it

Account administrators can make 2-step verification mandatory for everyone on the account, under Account Settings > Security and Privacy > Require 2-step Verification. They have to turn it on for themselves first (Optimizely). Optimizely's security advice says anyone with the Administrator or Project Owner role should use it (Optimizely).

Signing in afterwards

Every time you sign in, Optimizely asks for your username and password, then a current code from your app. Type it and click Verify before it changes (Optimizely). The documentation doesn't mention a way to trust a device and skip the code.

Backup codes

Each backup code gets you in once and then stops working. To get a fresh set, go to Profile > Preferences > 2-step Verification and click Generate New Backup Codes. All your older codes stop working at that point (Optimizely).

Unless you've made a Novaz backup, its keys exist only on your iPhone, so these codes are your way back in if that phone is gone. They're worth keeping even with a backup, in case it's out of date. Keep them on paper or in a password manager, not on the same phone. More in 2FA backup codes.

If Optimizely rejects your code

Optimizely blames rejected codes on the clock, and its instructions are for the Google Authenticator app on Android. On an iPhone the fix is the phone's own clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

Optimizely lists these steps, in this order (Optimizely):

1. Sign in with one of your backup codes.
2. Check the time settings (see above).
3. If you're still signed in somewhere else, such as on another computer, turn 2-step verification off in your account settings.
4. Ask an administrator on your Optimizely account to open a support ticket for you, giving the email address of the locked account. If you are the administrator, another administrator has to file it.

The documentation doesn't say what else Support asks for or how long a reset takes. See also Lost the phone with your authenticator app?

Changing phones

Optimizely doesn't describe moving the code to a new phone. The safe route, while you can still sign in on the old one, is to turn 2-step verification off and enable it again with the new iPhone. If you use Novaz's iCloud backup or keep a backup file, you can restore your accounts on the new iPhone instead, and the Optimizely codes keep working. See How to transfer your authenticator app to a new iPhone.

Turning 2-step verification off

In your account settings, select Disable, click Save, and enter your Optimizely password (Optimizely). Optimizely's page sends you to Profile in one place and account settings in another, so look in both if you don't see it. If your admin requires 2-step verification, you may not be able to turn it off.

If your organization uses Opti ID

Opti ID handles multi-factor authentication differently. An administrator switches it on for the whole organization in the Optimizely Admin Center, under Settings > Authentication > SSO, and it only works with local Opti ID logins, not with your company's single sign-on. At your next sign-in you're asked to set up Okta Verify by scanning a QR code, and you can add a phone for text-message codes (Optimizely).

Those instructions only name Okta Verify, so we can't say whether Novaz is accepted there. With single sign-on, 2FA belongs to your company's identity provider.

Official Optimizely help

• Configure individual user 2-step verification
• Configure 2-step verification for all collaborators
• Apply account-level security best practices
• Set up multi-factor authentication (Opti ID)