ORCID 2FA: how to set up an authenticator app

Your ORCID account holds your ORCID record, the researcher identifier that journals, funders and universities ask for when you submit a manuscript or apply for a grant (ORCID). Two-factor authentication (2FA) is optional on ORCID and comes in one form: a six-digit code from an authenticator app, with one-time recovery codes as the fallback (ORCID). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

Plan for one thing before you start: ORCID shows your recovery codes once, at the end of setup, and never again.

How we checked this guide: the ORCID steps come from ORCID's own help center, including the screenshots in its articles, which we read on October 19, 2026. We haven't tested them on an ORCID account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

ORCID's help describes these steps (ORCID):

1. Sign in to ORCID and open your Account Settings page, at orcid.org/account (ORCID).
2. In the Two-factor authentication section, which shows (OFF), click Turn on two-factor authentication.
3. ORCID shows a QR code and a text code. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If ORCID is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. If you can't scan it, tap +, then Enter key manually in Novaz. Type ORCID as the Service and the text code as the Setup key. See What is a 2FA setup key?
5. Enter the six-digit code from Novaz in ORCID to finish.
6. Download or copy the recovery codes ORCID now shows, before you leave the page.

The section then shows (ON).

ORCID's help doesn't say how often its codes change or how long the text code is. A key typed into Novaz always makes six-digit codes every 30 seconds, so scan the QR code when you can: it carries the exact settings.

ORCID names four apps it has tested (Authy, FreeOTP, Google Authenticator and Microsoft Authenticator), but its FAQ says any app that scans a QR code or takes a key will do.

Save the recovery codes now

ORCID is blunt about this: you can download or copy the list only once, and "ORCID does not store a backup" (ORCID). It suggests a safe place such as a password manager.

• Each code works once. Reusing one gives an Invalid recovery code error.
• If you lose the list or use it up, turn 2FA off and on again in Account Settings. Each time you turn it on, you get a new list. You also go through the QR code step again, so add ORCID to Novaz again and, once the new entry works, remove the old one: open it and tap Remove account.

If you haven't made a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, and these codes are your way back in. They also cover you if your backup is older than your ORCID entry. More in 2FA backup codes.

Signing in with 2FA on

ORCID's settings screen says it will ask for the code every time you sign in. That's true whether you use your email or ORCID iD and password, or a linked institutional account: the code is always the second step (ORCID). On the Two-factor authentication screen, type the code in Two-factor authentication code and click Authenticate. ORCID's help doesn't mention remembering a device.

Journal and grant systems that connect to your iD send you to an ORCID sign-in screen (ORCID), so keep your phone nearby when you submit.

If ORCID rejects your code

ORCID's help doesn't cover rejected app codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Moving to a new iPhone

ORCID's help doesn't describe moving 2FA to another phone. The documented route is turning 2FA off and on again in Account Settings, which also gives you new recovery codes. Do it while you still have the old phone, and scan the new QR code with the new one. If you use Novaz's iCloud backup or keep a backup file, you can restore your accounts on the new iPhone instead and skip that step. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. On the Two-factor authentication screen, click Enter a recovery code (ORCID's text calls it Enter recovery code) and type one of your saved codes.
2. Once you're in, turn 2FA off and on again to set up your new phone and get a new list.
3. With no app and no codes, use the Contact support link on the same screen. ORCID warns that you can lose the account this way, but its FAQ still tells you to ask its support team for help (ORCID). ORCID doesn't say what proof it asks for or how long it takes. Include your ORCID iD in your message.

More in Lost the phone with your authenticator app?

Turning 2FA off

You can turn it off at any time in the Two-factor authentication section of Account Settings. ORCID's text says to click Disable, while its screenshot shows Turn off two-factor authentication, so the label may differ (ORCID).

Official ORCID help

• Secure your account with two-factor authentication
• Account settings
• What is an ORCID iD and how do I use it?