Ravelin 2FA: how to set up an authenticator app for the dashboard

Ravelin sells fraud detection and payment tools to online businesses, and its dashboard is where a merchant's risk and fraud team reviews orders, customers and rules. You don't choose whether to use two-factor authentication there. Ravelin requires it for every user who signs in with a username and password, and it asks you to set it up the first time you sign in (Ravelin, archived). The method is an authenticator app. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Ravelin details come from Ravelin's own support site, linked below. Its pages at support.ravelin.com only show their text in a full web browser, so our automated reader couldn't open them. We read the copies saved on web.archive.org on December 7, 2025, on October 24, 2026. We haven't tested anything on a Ravelin account, and labels may have changed since. The Novaz steps are checked against the app, version 1.0.5.

Who has to use it

• Anyone who signs in with a password: 2FA is mandatory, with no opt-out described.
• Teams on single sign-on: an admin can switch on Mandatory SSO, which makes SSO the only way in for non-admins with a supported email domain (Ravelin, archived). Those users then aren't asked for Ravelin's 2FA, because they never use a password. Admins still are.

If your company signs you in through its own identity provider, any second step comes from that provider, not from Ravelin.

Set up the authenticator app at first sign-in

Ravelin's page describes the setup only briefly: you're prompted to scan a QR code with an authenticator app, which then gives you a one-time passcode each time you sign in (Ravelin, archived). It doesn't list the buttons on the setup screen. In practice:

1. Sign in to the Ravelin dashboard with your username and password for the first time.
2. When Ravelin shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at the screen. If the dashboard is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
3. Type the code Novaz shows into Ravelin to finish.

Ravelin's page doesn't mention a text key you could type instead of scanning, so plan on using the QR code. It also doesn't give the code length or how often codes change. Scanning passes those settings to Novaz, which is one more reason to scan rather than type.

Backup codes

The page mentions backup codes once, in passing, as something you might lose along with your phone. It doesn't say how many you get, when they're shown, or how to make new ones. If Ravelin gives you codes during setup, save them somewhere other than your phone. If you have no Novaz backup (iCloud backup or a backup file), the keys exist only on your iPhone, so those codes would be your spare way in.

If Ravelin rejects your code

Ravelin's help doesn't cover rejected codes. The usual cause is the phone's clock. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Moving to a new phone

Ravelin lets you replace your 2FA setup yourself. Click your avatar at the top right of the dashboard, choose Settings, then open the User Settings tab (Ravelin, archived). An older 2021 version of the same article called this the 2FA tab, so the name may vary (Ravelin, archived 2023).

Do this while you can still sign in, and scan the new QR code with Novaz on the new iPhone. You can skip the reset if you keep a Novaz iCloud backup or backup file: restoring it on the new iPhone brings Ravelin over with your other accounts. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Ravelin's page says the User Settings option is meant for exactly this case: no authenticator device and no backup codes. But you have to be signed in to reach that page, and the page doesn't explain how to do that without a code.

The route that works when you're locked out is your team's admin. Admins can open your profile and choose Reset 2FA (Ravelin, archived). You'd then set it up again at your next sign-in. Ravelin's page doesn't say what to do if you are the only admin, so ask your Ravelin contact before that happens. More in Lost the phone with your authenticator app?

For admins: who has it set up

The Team tab under Settings has a Two Factor Auth column. A green check means that person has set up 2FA, and a red cross means they haven't.

Turning 2FA off

You can't, as far as Ravelin's help says. It's mandatory for password sign-ins. The only documented way around it is Mandatory SSO, and that applies to non-admins only.

Official Ravelin help

• Two Factor Authentication (read in the archived copy of December 7, 2025)
• Single Sign On (SSO) (read in the archived copy of December 7, 2025)
• Two Factor Authentication, 2021 version (archived copy of September 26, 2023)