Piwik PRO 2FA: how to set up an authenticator app

Your Piwik PRO login opens your organization's analytics reports, tags and consent settings. Its two-factor authentication (2FA) has one method: an authenticator app making six-digit codes, plus backup codes. The help describes no text-message or email codes. You can turn 2FA on for yourself, or an account owner can make it required for every user (Piwik PRO). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Piwik PRO steps come from Piwik PRO's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a Piwik PRO account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Required or optional

That's up to the owner. In Menu > Administration > Account > Account settings, an owner can turn on 2FA for all users and click Turn on. Piwik PRO then signs everyone out, and each person sets up 2FA at their next login (Piwik PRO). Its HIPAA page names 2FA, or single sign-on, as how owners meet HIPAA's user-authentication rule (Piwik PRO).

With SAML single sign-on, an Enterprise feature, your identity provider handles the login (Piwik PRO). The pages don't say how Piwik PRO's 2FA fits with SSO.

Turn on 2FA with an authenticator app

To turn it on just for yourself (Piwik PRO):

1. Log in to Piwik PRO.
2. Open Menu and choose your email address.
3. On the left, click Security.
4. In 2FA via a mobile app, click Turn on.
5. Piwik PRO shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
6. Can't scan? Use the secret key shown below the QR code. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
7. Type the six-digit code from Novaz into the input fields in Piwik PRO.
8. Copy your backup codes and store them. Piwik PRO won't show them again once you leave this screen.

If an owner made 2FA required, the QR code appears at your next login, right after your password, and steps 5 to 8 are the same. One of Piwik PRO's lists repeats the backup-code step and skips the scan; the order above follows its other walkthroughs.

The codes are six digits and usually last 30 seconds (Piwik PRO), which matches a typed key in Novaz. Novaz needs a typed key of at least 16 characters, so scan if the key is shorter.

Your backup codes

You see them once, at setup. Without your phone, any of them gets you in, and one also works for turning 2FA off. A reset or turning 2FA off cancels them, and setting up again gives you new ones (Piwik PRO). The help doesn't say how many there are or whether each works only once.

If you haven't made a Novaz backup, its keys exist only on your iPhone, so these codes are your way back in. Store them away from the phone. More in 2FA backup codes.

When Piwik PRO asks for a code

Every time you log in: your email, your password, then a six-digit code (Piwik PRO). The help doesn't mention a way to remember a trusted device.

If Piwik PRO rejects your code

The help doesn't cover this. Usually it's the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. After a reset, the old Piwik PRO entry in Novaz belongs to the previous setup, so open it and tap Remove account. More in Authenticator code not working?

Changing phones

Keep the old phone until you're done (Piwik PRO):

1. Go to Menu, choose your email address, then Security.
2. In 2FA via a mobile app, click Turn off, enter a code from the old phone (or a backup code), and select Turn off.
3. Select Turn on again (labeled Two-factor authentication here), scan the new QR code with the new phone, type the code, copy the new backup codes, and select Done.

Piwik PRO writes this for accounts where 2FA is required; its own Turn off and Turn on steps do the same if you turned it on yourself. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead of going through these steps. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use a backup code at login.
2. Ask an owner. Any owner can reset it: Menu > Administration > Users, select your user, click Reset 2FA, then Reset. You set it up again at your next login (Piwik PRO).
3. If you're the only owner, contact Piwik PRO: Enterprise clients by email or in-app chat, Business customers through the community forum (Piwik PRO). The help doesn't say what proof it asks for or how long it takes. The forum is public, so never post a code or key there.

More in Lost the phone with your authenticator app?

Turning 2FA off

If 2FA isn't required, go to Menu, your email address, Security. In 2FA via a mobile app, click Turn off, enter a code or a backup code, and click Turn off (Piwik PRO).

An owner lifts the requirement by turning off 2FA for all users in Account settings and clicking Turn off. People who set up 2FA keep it until they turn it off (Piwik PRO).

Official Piwik PRO help

• Set up two-factor authentication (2FA)
• Add and manage users
• Set up SAML single sign-on (SSO)
• Piwik PRO and customer shared responsibility for HIPAA compliance