Oracle Cloud Infrastructure 2FA: how to set up an authenticator app

Oracle Cloud Infrastructure (OCI) is Oracle's cloud platform, run from the Oracle Cloud Console at cloud.oracle.com. For most accounts, the second sign-in step isn't optional. Oracle's default Console policy, Security Policy for OCI Console, makes every local user enroll and give a second factor at each sign-in. Oracle says it's on by default, unless a tenancy changed its sign-on settings or signs in through an outside identity provider (Oracle). Oracle's Free Tier tutorial says the first-sign-in prompt "cannot be dismissed and is mandatory now" (Oracle).

Oracle calls it 2-step verification. That default policy turns on mobile app passcodes, push prompts in Oracle's own app, bypass codes and FIDO security keys, though your administrator decides what you see. Oracle steers you to its Oracle Mobile Authenticator but accepts any app that makes standard time-based codes, with no extra setup by the administrator (Oracle). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Oracle steps come from Oracle's own OCI documentation and tutorials, linked below, which we read on October 20, 2026. We haven't tested them on an Oracle Cloud account, so a label may differ slightly. Oracle's pages mostly describe its own app, so the steps for other apps rest on fewer pages. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2-step verification with an authenticator app

The QR code Oracle shows first is for its own app, which fetches its secret online; only offline enrollment puts the secret in the QR code (Oracle). So for Novaz, tick Offline mode or use another authenticator app before you scan.

At your first sign-in, Oracle starts the setup: select Enable Secure Verification, then Mobile App (Oracle), and go on from step 4. To add the app later, Oracle documents this path (Oracle):

1. Sign in to the Console on a computer.
2. Open the Profile menu, select User settings, then the Security tab. If 2-step verification has never been on, select Enable in the 2-Step verification section and pick the mobile app (Oracle).
3. In the 2-step verification section, under Mobile app, select Configure. The Mobile application page opens.
4. Tick Offline mode or use another authenticator app. Oracle's older Identity Cloud Service page says this brings up an offline QR code for other apps (Oracle).
5. In Novaz, tap +, then Scan QR code. If the Console is on the same iPhone, take a screenshot and use Choose a photo (how that works).
6. Can't scan? Select Enter key manually and Oracle shows the key. In Novaz, tap +, then Enter key manually, fill in Service and Account (your Oracle username), and type the key as the Setup key (about setup keys).
7. Type the current Novaz code on the page and select Verify.

Scan rather than type if you can. An administrator sets the domain's Passcode generation interval (seconds) (Oracle), and Oracle says codes change every 30 to 60 seconds (Oracle). A typed key always gets 30 seconds in Novaz, while a QR code can carry a different interval. Novaz shows the one it uses as Interval under Details.

No Security tab means your administrator hasn't turned on account recovery and MFA for you (Oracle).

Generate a bypass code

Instead of a list of backup codes, Oracle has bypass codes. On the Security tab, under Bypass codes, select Generate, store the code, and select Close. A code you make yourself never expires but works only once (Oracle, Oracle). Without a Novaz backup, its keys live only on your iPhone, so this code is your way back in: keep it off the phone. See 2FA backup codes.

When Oracle asks for a code

At every Console sign-in, under the default policy. Opening My Profile or My Apps asks again, even within the same session (Oracle). If your administrator allows it, a checkbox on the code screen lets you trust the computer for a set number of days (Oracle).

If the page asks for a different method, select Show alternative login methods, and tick Make this my default method to keep your choice (Oracle).

If Oracle rejects your code

Oracle tolerates at most 90 seconds of clock difference between its server and your device (Oracle). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If you typed the key, the interval above may be the cause. More in Authenticator code not working?

Moving to a new iPhone

Oracle's documented route: an identity domain administrator resets your authentication factors, then you sign out, sign back in and enroll again (Oracle). A reset clears every factor you had (Oracle). With Novaz you can skip that if you turned on iCloud backup or kept a backup file: restore your accounts on the new iPhone and the Oracle codes keep working. Without a backup, add Oracle again on the new phone. See moving to a new iPhone.

If you lose your authenticator

1. On the code screen, select Show alternative login methods and use your bypass code or another method.
2. Otherwise, contact your administrator, whose details Oracle says are usually in your account activation email. They can reset your factors or make you a bypass code (Oracle, Oracle).
3. If there's no administrator to ask, contact Oracle support. Free Tier account holders must use live chat: on Oracle's contact page, select Open a live chat, then Get Support, Cloud Infrastructure (OCI) including Free Trial and Cloud Support Chat (Oracle, Oracle).

Oracle doesn't say what proof support asks for or how long a reset takes. More in Lost the phone with your authenticator app?

Turning it off

You can remove a factor from its Actions menu (three dots) in the 2-Step verification section, but not the last one (Oracle). While the default Console policy is active, 2-step verification stays on.

Official Oracle help

• Identity Domains With the "Security Policy for OCI Console" Sign-On Policy
• Using Mobile Authenticator Apps with MFA
• Adding an Account to the OMA App by Entering the Key Manually
• Generating a Bypass Code
• Using the Oracle Mobile Authenticator
• Registering New And Reregistering Existing Mobile Devices
• Troubleshooting Signing In to the Console
• Get Started with OCI and OCI Console Using a Free Account