Recurly 2FA: how to set up an authenticator app

This guide covers the login for the Recurly app, where businesses run subscription billing. Recurly offers three two-factor authentication (2FA) methods: an authenticator app, SMS and email. You can turn on more than one, and Recurly recommends the authenticator app and email over SMS. The setting is personal, but it reaches further than one workspace: it applies to every Recurly site linked to your email address, so turning it on or off changes all of them at once (Recurly).

Two changes are under way. Recurly has moved authenticator apps to a new TOTP service, and people who set one up earlier are asked to set it up again. SMS is also no longer offered to users on new sandbox sites (Recurly).

We use Authenticator App - Novaz on iPhone below. Any authenticator app works the same way.

How we checked this guide: the Recurly steps come from Recurly's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a Recurly account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

If your company uses single sign-on

If your team signs in to Recurly through Okta, Microsoft Entra or Google, you won't use Recurly's own 2FA. When an admin switches a user to single sign-on, Recurly turns that user's 2FA off, and your identity provider handles the extra check instead (Recurly).

Turn on 2FA with an authenticator app

Recurly documents these steps (Recurly):

1. In the Recurly app, click your name in the upper right corner to open your profile.
2. In the two-factor section, click Enable next to Authenticator App.
3. Enter your Recurly password when asked.
4. Recurly shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If Recurly is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you'd rather type it, Recurly also shows a code to enter by hand. In Novaz, tap +, then Enter key manually, put "Recurly" under Service, and type that code as the Setup key. See What is a 2FA setup key?
6. Type the one-time code that Novaz shows into Recurly to finish.

Recurly doesn't say how many digits its codes have or how often they change, so scanning the QR code is the safer choice: it carries those settings to your app.

Already using an authenticator with Recurly?

If you set up an authenticator app before Recurly's switch to its new TOTP service, Recurly says you need to redo it (Recurly):

1. In your profile, click the ellipsis (…) to the right of Authenticator App and choose Disable, then confirm.
2. Delete the old Recurly entry from your authenticator app. In Novaz, open it and tap Remove account.
3. Set up the authenticator app again with the steps above.

No backup codes, so add a second method

Recurly's documentation doesn't mention backup or recovery codes. What it suggests instead is a second method. If you have both the authenticator app and email on, you can sign in with an email code when your phone is gone (Recurly).

That matters with Novaz, because without an iCloud backup or a backup file, its keys exist only on your iPhone. So after you set up the app, click Enable next to Email too. Recurly sends a code to the email on your account to confirm it.

With more than one method on, you can pick the one Recurly offers first at login: click the ellipsis next to it, choose Set as Default, enter your password, and confirm with Set as Default (Recurly).

Recurly logs you out after 20 minutes of inactivity, so you'll sign in again often. Its documentation doesn't say whether it remembers trusted devices.

If Recurly rejects your code

Recurly's own tips are short: if codes keep failing, sync your phone's clock, and type the code without spaces between the digits (Recurly). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

If you keep a Novaz iCloud backup or backup file, restore it on the new iPhone and your Recurly codes keep working. Without one, while you still have the old phone, disable Authenticator App in your Recurly profile and enable it again with the new phone. If you have email set up as a second method, you can also sign in with an email code and set the authenticator up again on the new device, as Recurly suggests (Recurly). See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Recurly lists these routes for a lost device (Recurly):

• Email code: if email is one of your methods, choose it at login, then set up the authenticator again.
• Your site administrator: a Site Admin can open your user in the Users section, select Password, and click Save Changes. You can then sign in with just your password.
• Recurly Support: email support@recurly.com, and Support can turn 2FA off for you.

Recurly doesn't say what proof Support asks for or how long it takes. Once you're back in, turn 2FA on again. More in Lost the phone with your authenticator app?

Turning 2FA off

To drop just the authenticator, click the ellipsis next to Authenticator App, choose Disable, enter your password and click Disable. To remove every method, click Disable Two-Factor Auth on your profile page, enter your password and click Disable (Recurly).

Official Recurly help

• Profile (includes the two-factor authentication section)
• Single sign-on