Railway 2FA: how to set up an authenticator app

Railway lets you protect your account with an authenticator app, passkeys, and recovery codes. "Most TOTP applications are supported", and Railway asks for a code at sign-in and before destructive actions, not only at sign-in (Railway). Workspace admins on the Pro plan or above can require two-factor authentication for everyone (Railway). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Railway steps come from Railway's own documentation, linked below, which we read on October 11, 2026. We haven't tested them on a Railway account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA

Railway's documentation describes these steps (Railway):

1. Click your profile photo at the top right, choose Account Settings, and open the security page (railway.com/account/security).
2. Choose Set up two-factor authentication. Railway shows a QR code.
3. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. Type the code from Novaz into Railway.
5. Save your recovery codes. Each one works only once. You can view them and generate a new set later from your account settings. See 2FA backup codes.

Add a passkey too

Railway also lets you add passkeys, with Add Passkey on the same page. Railway describes passkeys as an extra verification step that works like two-factor authentication (Railway changelog). A passkey on another device gives you a second way in if you lose your phone.

When Railway asks for a code

• At sign-in.
• Before destructive actions, such as deleting a project. The Railway CLI has a --2fa-code option for this (Railway).

Project and workspace tokens keep working when two-factor authentication is required, so automated deployments don't break (Railway).

If you lose your authenticator

Use a recovery code or a passkey. Railway's documentation stops there. On Railway's official forum, in September 2026, Railway asked people who lost access to prove they own the account. One way is a public GitHub repository named Railway-2FA-Reset on the GitHub account linked to Railway. Another is to email Railway from the address on the account. A Railway employee wrote: "We can only remove 2FA for the account owner themselves" (Railway Station). More in Lost the phone with your authenticator app?

If your code is rejected

Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Official Railway docs

• Accounts
• Multi-factor authentication
• Two-factor enforcement