Skip to content
Novaz AuthenticatorGET

PyPI 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. What changes when you sign in
  3. Keep the remaining recovery codes safe
  4. If PyPI rejects your code
  5. Changing phones, and no off switch
  6. If you lose your authenticator
  7. Official PyPI help

You need a PyPI account to publish and manage packages on the Python Package Index, but not to install them. Since January 1, 2024, two-factor authentication (2FA) is mandatory on PyPI: without it you can still sign in and browse, but you can't upload or manage anything (PyPI, PyPI).

The methods are an authenticator app (TOTP) or a security device such as a USB key, with one-time recovery codes as the backup. There are no text-message codes (PyPI). The unusual part is the order: PyPI won't let you add an authenticator app until you've saved your recovery codes and proved it by using one. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the PyPI steps come from PyPI's own help page and blog, and from the source code of PyPI's account pages, which PyPI publishes on GitHub. We read all of them on October 20, 2026. We haven't tested them on a PyPI account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

First make sure your primary email address is verified: PyPI won't offer 2FA until it is (PyPI).

  1. Sign in at pypi.org, open Account settings, and go to Two factor authentication (2FA) (its own page, at pypi.org/manage/account/two-factor/). PyPI may ask for your password again if you haven't confirmed it in the last hour (PyPI).
  2. Select Generate recovery codes. PyPI shows eight codes, and only this once. Save them with Copy or Download as file, then select Continue (PyPI).
  3. Back in the 2FA section, select Use a recovery code, type one of your codes in Enter recovery code, and select Verify. This proves to PyPI that you stored them, and uses up that code (PyPI).
  4. Select Add 2FA with authentication application.
  5. On the Set up 2FA with an authentication application (TOTP) page, PyPI shows a QR code. In Novaz, tap +, then Scan QR code. On the same iPhone, take a screenshot and use Choose a photo (how).
  6. If you can't scan it, look under No QR scanner? for the same key as text. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. PyPI uses standard 6-digit, 30-second codes, so a typed key works (PyPI). See What is a 2FA setup key?
  7. Type the 6-digit code from Novaz in Verify application, then select Set up application (PyPI).

PyPI allows only one authenticator app per account, so you can't add it to a second phone as well (PyPI).

What changes when you sign in

You enter your username and password, then the code from Novaz in Enter authentication code (PyPI). The same screen has a box to remember the device for a number of days (PyPI).

Since November 2025, an authenticator-code sign-in from a device or browser PyPI doesn't recognize also needs your email: you click the link in a message titled "Unrecognized login to your PyPI account", and the device is trusted from then on (PyPI). If you didn't just sign in, don't click it; change your password.

Uploads don't ask for your 2FA code. Tools like twine use an API token or Trusted Publishing instead (PyPI).

Keep the remaining recovery codes safe

After step 3 you have seven codes left. Each works once and is meant for recovery only (PyPI). These codes are your way back in if the phone is gone and there's no Novaz backup to restore. Keep them in a password manager or on paper, away from the phone. If you use some or lose them, select Regenerate next to Recovery codes in the 2FA section for a fresh set. See 2FA backup codes.

If PyPI rejects your code

PyPI's help points to a phone clock that's out of sync as a common cause of authenticator setup trouble (PyPI). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when it's 15 seconds or more off. More causes: Authenticator code not working?

Changing phones, and no off switch

PyPI's settings page says 2FA can't be turned off once it's on, and you can't remove your only method: you must add another first (PyPI). PyPI's help doesn't describe moving to a new phone, and a second app isn't allowed, so the route the settings leave is: add a security device (PyPI's blog also recommends passkeys), select Remove next to the authenticator app, then set it up again on the new phone (PyPI). Do it while you still have the old phone.

With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone; see moving to a new iPhone.

If you lose your authenticator

At sign-in, enter your username and password, then choose Login using recovery codes and type one of your codes (PyPI). Once you're in, replace the lost app the same way as for a new phone, and regenerate your codes.

Without recovery codes, PyPI warns that you may lose the account for good (PyPI). The last resort is an account recovery request on PyPI's support tracker on GitHub (PyPI). The form asks for your username and the reason, and warns that replies can be a week or more apart (PyPI). More in Lost the phone with your authenticator app?

Official PyPI help

More guides: Developer tools