Raspberry Pi 2FA: how to set up an authenticator app for your Raspberry Pi ID
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
A Raspberry Pi ID, created at id.raspberrypi.com, signs you in to Raspberry Pi's online services: Raspberry Pi Connect, which lets you reach your Pi's desktop or shell from a browser (Raspberry Pi), and the contributor-only titles in the Bookshelf app (Raspberry Pi). Its two-factor authentication (2FA) uses codes from an authenticator app; no text-message or email option is described (Raspberry Pi).
Plan for the recovery code before you start. Raspberry Pi shows it once, at the end of setup, and calls it "the only way to bypass 2FA" if you lose your phone and app (Raspberry Pi).
The steps below use Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Raspberry Pi steps come from Raspberry Pi's own documentation and its screenshots of the setup screens, linked below, which we read on October 20, 2026. We haven't tested them on a Raspberry Pi ID. Some screenshots date from 2023, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Do you have to turn it on?
For a personal account, no, though Raspberry Pi's Connect documentation suggests it, for example after an email about a linked device you don't recognize (Raspberry Pi).
An organization can make it mandatory. In Raspberry Pi Connect for Organisations, an admin selects Require two-factor authentication on the organization's Settings tab. Members who haven't set up 2FA see a banner for 14 days. After that, they're shut out of the organization's devices and other resources until they turn 2FA on for their Raspberry Pi ID (Raspberry Pi). Stop requiring two-factor authentication lifts the rule; switching it off and on again restarts the 14 days.
Turn on 2FA with an authenticator app
Raspberry Pi's documentation and screenshots show this flow (Raspberry Pi):
- Sign in to your Raspberry Pi ID at id.raspberrypi.com.
- Click Two-factor authentication.
- A page titled Two-factor authentication shows a QR code. Open Novaz, tap +, choose Scan QR code, and hold the iPhone up to the screen. If the page is open on the same iPhone, take a screenshot and pick it with Choose a photo. See How to scan an authenticator QR code on the same iPhone.
- Can't scan? The page has a Trouble scanning the QR code? link, though the documentation doesn't say what it shows. If it gives you a text key, tap + in Novaz, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
- Type the 6-digit code Novaz shows into the box, then click Verify and set up.
- A Two-factor authentication enabled notice appears above your recovery code. Click Copy to clipboard or write the code down. The screen warns that you won't see it again.
Raspberry Pi doesn't say how often its codes change, so scanning beats typing: the QR code tells Novaz the exact timing, and a typed key is always set to 30 seconds.
The documentation also notes that on a Mac or iPhone you can right-click the QR code and choose Set up verification code to use iCloud Keychain instead. See Apple Passwords vs an authenticator app.
Your one recovery code
Raspberry Pi ID gives you one recovery code, not a list. The setup screen says it gets you past two-factor authentication if your authenticator app is gone. Raspberry Pi doesn't say whether it works more than once or how to get a new one.
Unless you've set up a Novaz backup (iCloud backup or a backup file), the keys exist only on your iPhone, so this code is your spare key. Keep it on paper or in a password manager, not only on the phone that runs Novaz. More in 2FA backup codes.
When you'll need a code
With 2FA on, every sign-in to your Raspberry Pi ID asks for a code from your app on top of your password (Raspberry Pi). The documentation doesn't mention remembering a trusted browser.
Raspberry Pi Connect adds its own check. You can only start a remote session if you've authenticated with your Raspberry Pi ID within the past hour (Raspberry Pi). If your last sign-in is older, you may have to sign in again, code included.
If Raspberry Pi rejects your code
Raspberry Pi's documentation doesn't cover rejected codes. Most of the time the iPhone's clock is to blame. Go to Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning if the clock drifts by 15 seconds or more. More fixes in Authenticator code not working?
New phone, or turning 2FA off
Raspberry Pi doesn't describe moving 2FA to another phone, but it does say you can switch it off at id.raspberrypi.com at any time (Raspberry Pi). So, while the old phone still works, turn 2FA off, set it up again on the new phone, and save the new recovery code. If your Connect organization requires 2FA, don't leave it off: members without it get blocked. If you keep a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and leave 2FA on. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with your recovery code. Raspberry Pi's documentation offers nothing beyond it: no reset form and no support process for lost codes.
If you've lost the code as well, the nearest thing is Raspberry Pi's contact form, which lists Raspberry Pi ID accounts as a subject (Raspberry Pi). Raspberry Pi doesn't say whether its team can remove 2FA from an account, what proof it would want, or how long it would take. More in Lost the phone with your authenticator app?
