Red Hat 2FA: how to set up an authenticator app

One Red Hat login covers the Customer Portal, the Hybrid Cloud Console, Red Hat Developer and Partner Connect, because they all sign you in through sso.redhat.com (Red Hat). Two-factor authentication (2FA) is optional unless an Organization Administrator requires it for the whole organization, in which case you can't turn it off (Red Hat).

The only method is a time-based code from an authenticator app, plus recovery codes. There's no text-message option and no hardware token. Red Hat is also strict about apps: it names Google Authenticator and FreeOTP as the only supported ones and says other apps aren't supported (Red Hat). This guide uses Authenticator App - Novaz on iPhone. Red Hat's setup is the standard kind (a QR code or a 32-character key, 6-digit codes every 30 seconds), which Novaz reads, but Novaz isn't on Red Hat's list. Red Hat's side of the steps is the same whichever app you pick.

How we checked this guide: the Red Hat steps come from Red Hat's own documentation and Customer Portal knowledge base, linked below, which we read on October 20, 2026. We haven't tested them on a Red Hat account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First, verify your email and phone

Red Hat wants a verified email address and a phone number that takes voice calls on accounts with 2FA, for lockout recovery (Red Hat). Add the phone number, with country code, on the Account details page and click Submit.

Turn on 2FA with an authenticator app

From Red Hat's documentation (Red Hat):

1. Log in to a Red Hat site, such as the Customer Portal.
2. Click your avatar in the top right, then Account details (in the Hybrid Cloud Console, My profile).
3. Click Login & password, then Manage two-factor authentication. The Signing in page opens.
4. Click Set up authenticator application. Red Hat asks you to log in again, then shows a QR code.
5. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo (scanning a QR code on the same iPhone).
6. Can't scan? Click Unable to scan? Enter the key instead for the 32-character key. In Novaz, tap +, then Enter key manually, and put it in Setup key (What is a 2FA setup key?).
7. Type the code from Novaz into One-time code. Device name is optional.
8. Click Enable.

Red Hat's pages also write the button as Manage 2-factor authentication.

Make recovery codes straight away

Red Hat warns that skipping recovery codes can cost you the account (Red Hat). Without a Novaz iCloud backup or backup file, the keys exist only on your iPhone, so these codes are your way back in if it's lost. Go to Login & password > Manage 2-factor authentication, click Set up recovery codes, print, download or copy the list, then click Complete setup. Red Hat's page says your next login will ask for one of them, so keep the list handy.

Each code works once. For a new set, click Remove under Recovery codes and create them again. To sign in with one, click Try another way after your password. See 2FA backup codes.

For Organization Administrators

In the Hybrid Cloud Console, click the gear (Settings), then Authentication Policy and Authentication Factors. Check Enable two-factor authentication for your organization and click Save (Red Hat). The knowledge base puts this under Identity & Access Management, so the menu may differ (Red Hat).

When Red Hat asks for a code

At every login in a browser, after your password. Command-line logins still work with just a username and password (Red Hat). If no code prompt follows your password, 2FA is off for that login.

If Red Hat rejects your code

Red Hat suggests waiting a few seconds for the next code, and checking that you're reading the Red Hat entry if your app holds several (Red Hat). Also make sure your iPhone sets its own time: Settings > General > Date & Time > Set Automatically. Novaz warns when the clock is 15 seconds or more off. If nothing helps, contact Red Hat Support. More in Authenticator code not working?

Moving to a new phone

While you can still log in, remove the current authenticator and add a new one on the Signing in page (Red Hat). The old token stops working, and Red Hat leaves deleting stale tokens from your app to you (Red Hat). In Novaz, open the old Red Hat entry and tap Remove account. If you'd rather keep the same authenticator, restore a Novaz iCloud backup or backup file on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a recovery code. Without one, contact Red Hat Customer Service by phone, email or a support case (Red Hat). Its phone numbers are on its contact page (Red Hat). A request alone isn't enough:

• Customer Service calls the phone number on your account, and you confirm a one-time code it gives you. Red Hat says of this callback, "There are no exceptions to this process" (Red Hat).
• If the call can't be completed, Red Hat emails your account address that 2FA will be removed in seven days. You can reply to stop it.

See Lost the phone with your authenticator app?

Turning 2FA off

On the Signing in page, click Delete, log in again with a code, and click CONFIRM DELETION (Red Hat).

Official Red Hat help

• Secure Red Hat user accounts with two-factor authentication (2FA)
• Two Factor authentication (2FA) for Red Hat Customer Portal
• Contact Red Hat customer service