RapidAPI 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your RapidAPI account at rapidapi.com holds your API subscriptions, keys and billing, plus your listings and payouts if you publish APIs. Two-factor authentication (2FA) is optional. RapidAPI offers two methods: a code by text message (SMS) or a code from an authenticator app (RapidAPI). Either way, RapidAPI has you create recovery codes during setup.
This guide uses Authenticator App - Novaz on iPhone for the app side. Any authenticator app works the same way.
How we checked this guide: the RapidAPI steps come from RapidAPI's own documentation, linked below, which we read on October 21, 2026. Both pages were last updated in June 2025, and their screenshots date from 2020. We haven't tested the steps on a RapidAPI account, so a label may differ slightly. RapidAPI's support site refused our plain request for its web pages, so we read its public article list through the help center's own open feed instead; none of those articles covers 2FA. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
RapidAPI's documentation keeps this short (RapidAPI):
- Sign in at rapidapi.com, click your user icon in the upper right, and choose User Settings.
- Find the two-factor section. In RapidAPI's screenshot it's headed Two-Factor Authentication, with a Setup Two-Factor Authentication button under it.
- Next to the authenticator app option, click the Setup link. RapidAPI shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Back on RapidAPI, enter the code Novaz shows and click Test Code. That confirms the code and turns on authenticator app verification.
- Generate your recovery codes, which RapidAPI requires, and download them.
RapidAPI's pages don't mention a text key you can type in place of the QR code, and they don't say how many digits its codes have or how often they change. Scanning passes those settings to Novaz, so scan rather than type. If you do find a key and want to type it, tap +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
Recovery codes are part of the setup
RapidAPI says it plainly: "Both methods of authentication require generating recovery codes" (RapidAPI). They're for when you can't reach your 2FA method. You can download them, or generate a new set if you think someone has seen them.
Keep them somewhere other than your iPhone, such as a password manager on another device or a printed copy. If the iPhone is lost and you never made a Novaz backup (iCloud backup or a backup file), these codes are what gets you back in. More in 2FA backup codes.
RapidAPI's pages don't say whether SMS and an authenticator app can be on at the same time.
Signing in with Google, GitHub or Facebook
You can create a RapidAPI account with Google, GitHub or Facebook instead of a password. RapidAPI's documentation describes 2FA as a step added to your password, and notes that some settings, such as changing your password, aren't available to accounts that sign in that way (RapidAPI). It doesn't say whether the 2FA setting applies to them. If you sign in with one of those, protecting that Google, GitHub or Facebook account with 2FA is what keeps RapidAPI safe too.
If RapidAPI rejects your code
RapidAPI's documentation has no advice on rejected codes. The most common cause is the phone's clock. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?
New phone, lost phone
RapidAPI doesn't document a way to move the authenticator to a new phone. Novaz can do it for you if you keep an iCloud backup or a backup file: restore it on the new iPhone and your RapidAPI codes carry on. Without one, while you can still sign in, a workable route is to turn 2FA off and set it up again with the new phone, then save the new recovery codes. See How to transfer your authenticator app to a new iPhone.
If the phone is already gone, sign in with one of your recovery codes, which is what RapidAPI made them for. Then set 2FA up again on your new phone.
Without recovery codes, RapidAPI's documentation doesn't describe a recovery process, what proof it would ask for, or how long it would take. For other account problems its pages send you to the support site at support.rapidapi.com (RapidAPI), so that's the place to ask. More in Lost the phone with your authenticator app?
Turning 2FA off
In User Settings, click Turn Off Two-Factor Authentication (RapidAPI). The page doesn't say whether RapidAPI asks for a code first. Once it's off, open the RapidAPI entry in Novaz and tap Remove account.
Company API hubs
Some companies run their own API hub on RapidAPI's platform. If yours lets you sign in with an email address and password, the same 2FA steps apply there. RapidAPI's documentation for those hubs adds that the company can require 2FA for every user by asking its RapidAPI customer success contact (RapidAPI).
