Postman 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Postman account holds the collections and workspaces you sync between the desktop app and Postman on the web. Two-factor authentication (2FA) is optional and open to every Postman user (Postman). Postman documents one method: a code from an authenticator app, with single-use recovery codes as the fallback. No text message option is mentioned (Postman). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Postman steps come from Postman's own documentation and support center, linked below, which we read on October 20, 2026. We haven't tested them on a Postman account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Two things to know first
It's for password sign-ins. Postman offers the setting to people who sign in with a username or email address and a password (Postman). Its 2FA page doesn't cover signing in with Google or with SSO on an Enterprise team, which go through Google or your company (Postman). If you signed up with Google, Postman explains how to set a password from the Trouble Signing In page (Postman).
Turning it on signs you out everywhere. Postman ends all of your active sessions when you enable 2FA (Postman). You'll sign in again, with a code, on every computer and browser.
Turn on 2FA with an authenticator app
Postman's documentation lists these steps (Postman):
- Click your avatar in the Postman header, hover over your account entry, and click Account settings. Older docs say Settings > Account, so your menu may differ.
- Click Enable 2FA.
- Click Continue.
- Enter your password and click Verify.
- Link your authenticator app. In Novaz, tap +, then Scan QR code, and point the camera at the code. On the same iPhone, use a screenshot and Choose a photo (how).
- Type the six-digit code that Novaz shows and click Next.
- Download your recovery codes and put them somewhere safe.
- Click Done.
Postman's docs don't say whether the linking screen also shows a text key. If it does and you can't scan, tap + in Novaz, then Enter key manually, and type it as the Setup key (setup keys explained). Scanning is safer, since the QR code carries the exact code settings.
Your recovery codes
Each recovery code works once and signs you in without your phone (Postman). They're your way in if the phone is gone and you have no Novaz backup. Store them away from the phone.
For a fresh set, click Regenerate recovery codes in your account settings. Postman doesn't say how many codes you get or whether old ones stop working, so keep the newest set. More in 2FA backup codes.
When Postman asks for a code
With 2FA on, you need your password and a code every time you sign in (Postman). The desktop app sends you to your browser, where you enter the code and click Verify. You have five minutes before the app makes you start over (Postman).
With Stay signed in selected, you stay signed in until 30 days of inactivity, unless a team you belong to sets its own maximum session length (Postman).
If Postman rejects your code
Postman's pages don't cover rejected codes. Check the iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. Other causes are in Authenticator code not working?
Moving to a new iPhone
Postman doesn't document moving 2FA to another phone, but you can turn it off with your password and back on at any time (Postman). Before giving up the old phone, do that with Novaz on the new one, save the new recovery codes, and expect to be signed out everywhere again. If you restore Novaz from iCloud backup or a backup file instead, you can skip this. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
On the sign-in screen, click Use a recovery code and enter one of your saved codes. If you've lost the codes too, Postman says to email its support team at help@postman.com, sending from an email address registered to your account (Postman). Postman doesn't say what proof it asks for or how long this takes.
So keep that inbox. Postman's support team won't change an account's email address for you, to avoid giving the wrong person access (Postman). For an account on a former work address, Postman recommends asking that company's IT department for help. More in Lost the phone with your authenticator app?
Turning 2FA off
Open Account settings as above, click Disable 2FA, enter your password and click Disable 2FA again (Postman). Then open the Postman entry in Novaz and tap Remove account.
