Pennsylvania myPATH 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
myPATH (my Pennsylvania Tax Hub) is the online portal of the Pennsylvania Department of Revenue (PA Revenue). You use it to register tax accounts, file returns, make payments and manage your accounts. Many features work from the myPATH homepage without a username or password. Others need a profile (PA Revenue).
A profile comes with two-step verification. You set it up the first time you log in, and after that myPATH asks for a security code each time you log in. The code can come by text message, by email or from an authentication app (PA Revenue). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the myPATH steps come from PA Revenue's myPATH page on pa.gov, which we read on October 20, 2026, and from its help center at revenue-pa.custhelp.com. The help center blocks automated requests, so we read its articles in copies saved by the Internet Archive: the two-step verification article as saved on October 21, 2023 (last updated December 13, 2022), the sign-up article as saved on December 20, 2024, the lockout articles as saved on August 4, 2023 and March 19, 2025, and the login help index as saved on June 6, 2026. The live articles may have changed since. We haven't tested the steps on a myPATH profile, and the help doesn't show the authenticator setup screen, so a label may differ. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
- Log in at mypath.pa.gov with your myPATH username and password.
- On a new profile, the sign-up steps have you set up and confirm two-step verification right after that first login (PA Revenue). On an existing profile, select Manage My Profile, then Change Two-Step Settings (PA Revenue).
- Choose the authentication app as your method. The help lists it next to text message and email, but it doesn't name an app or describe the screen that follows.
- If myPATH shows a QR code, open Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- If it shows a key instead, tap +, then Enter key manually. Type myPATH as the Service and paste the key into Setup key. See What is a 2FA setup key?
- Enter the current code from Novaz in myPATH to confirm the setup.
PA Revenue doesn't publish its code length or interval. A typed key always gets 6-digit codes every 30 seconds in Novaz, so scan the QR code if there is one, since it carries the right settings.
No backup codes, so add a second method
None of the help articles we read mention backup or recovery codes. What PA Revenue does recommend is setting up more than one way to get a code, so you aren't held up when logging in (PA Revenue). Unless you've made a Novaz backup, its keys exist only on your iPhone, so add text message or email as well.
Keep your profile's email address current, because password resets arrive by email. The older lockout article puts the setting under Manage My Profile > Change Email, in the Profile panel (PA Revenue).
When myPATH asks for a code
Every login to a profile asks for a code. At the code screen, Trust this device skips it on that device and browser from then on. PA Revenue recommends it only on a personal device that the public can't reach. Clearing cookies or history, or logging in from another device or browser, brings the code back (PA Revenue).
The articles describe changing your methods, but not turning two-step verification off.
If myPATH rejects your code
The help has no advice on rejected authenticator codes. Its tips for missing codes are about texts and emails. It does warn that myPATH locks you out after several failed attempts to log in or enter information (PA Revenue). So find the cause before you retry. The usual one is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you're locked out, the two articles differ. The older one, from 2022, says locks usually reset overnight, so you can try again within 24 hours (PA Revenue). The newer one, from 2024, says you can usually unlock your profile with Forgot username or password on the myPATH homepage (PA Revenue).
Changing phones
You can change your methods at any time under Change Two-Step Settings, but the help doesn't explain how to replace an authenticator. Do it before you give up the old iPhone, while you can still log in. If you use Novaz's iCloud backup or keep a backup file, you can restore your accounts on the new iPhone; without one, you'll add myPATH again there. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
A second method, email or text message, is your way back in, though the help doesn't show how to pick it at the code screen. Once you're in, update Change Two-Step Settings.
Without one, PA Revenue says to contact it for technical help if you no longer have the device or email you chose (PA Revenue):
- Online: Submit a Question in the help center. The article says to create an account there and choose myPATH System Support as the tax category.
- Phone or email: the 2024 lockout article lists 717-425-2495, extension 72841 (PATH1 on a keypad), and mypath@pa.gov (PA Revenue).
These contact details come from copies saved in 2023 and 2025, so check the help center before you call. The articles don't say what proof of identity PA Revenue asks for or how long recovery takes. More in Lost the phone with your authenticator app?
