Report URI 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Report URI collects the browser reports your websites send, such as Content Security Policy violations, and it's where security teams watch which scripts run on their pages. Its two-factor authentication (2FA) is optional for a personal account, with one exception: a team owner can require it before you see a team's data. There are two kinds. One is a 6-digit code from an authenticator app, which Report URI calls TOTP. The other is a passkey. This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
The most important thing to know before you start is that Report URI has no support route back into a locked account. If you lose both your authenticator and your recovery code, the account is gone, and the only thing left is to ask Report URI to delete it so you can sign up again with the same email address (Report URI).
How we checked this guide: the Report URI steps come from Report URI's own documentation, linked below, which we read on October 21, 2026. The documentation site blocks automated requests, so we read archived copies of its pages from March 2026 on web.archive.org, including the screenshots. We haven't tested them on a Report URI account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Report URI's documentation describes these steps (Report URI):
- Sign in at report-uri.com and open the Settings page (report-uri.com/account/settings/). The newer passkey page calls the area that holds these options the Authentication section (Report URI). In the documentation's screenshot, the box is titled Two-Factor Authentication.
- Report URI shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If scanning doesn't work, select Can't scan the code?. A window titled 2FA secret code shows a 16-character key. In Novaz, tap +, then Enter key manually, type a name such as Report URI under Service, and paste or type the key as the Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz into the 6 digit code field and select Submit.
- A window called IMPORTANT NOTICE shows your recovery code. Save it before you do anything else, then select I have saved my recovery code.
Report URI's docs also mention typing the key into a password manager. Whichever app you use, keep the recovery code somewhere separate from it.
Your one recovery code
Report URI gives you one long recovery code, not a list of them. The notice says this code is "the ONLY way to gain access to your account again" if you can't make 2FA codes (Report URI). With Novaz, an iCloud backup or a backup file can bring your codes back on a new iPhone, but without one the keys exist only on your iPhone, and this code is all you have. Store it in a password manager or on paper, away from your phone. More on this in 2FA backup codes.
The authenticator page doesn't say how to get a new recovery code. The passkey page says you get a recovery code when you first add a passkey, and that turning passkeys off and on again from Settings gives you a new one (Report URI). Neither page says whether the authenticator and passkey methods share one code.
Signing in with a code
Once 2FA is on, Report URI asks for a code each time you sign in: after your email and password, a page with a 2FA Code field appears (Report URI). If you've also added a passkey, the same page offers Use Passkey (Report URI). The docs don't mention trusted or remembered devices.
If Report URI rejects your code
Report URI's docs don't cover rejected codes. Check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
On the sign-in page, select Can't generate a code?, type your recovery code into the Recovery Code field and select SUBMIT. This turns 2FA off so you can get in (Report URI). The passkey page calls this the Recover Account page (Report URI). Set up 2FA again as soon as you're in.
Without the recovery code, there is nothing else to try: no email reset, no identity check by support. You can only ask for the account to be deleted and register again (Report URI). See Lost the phone with your authenticator app?
Changing phones
Report URI doesn't describe a way to move 2FA to a new phone. If you keep a Novaz iCloud backup or backup file, restore it on the new iPhone and Report URI's codes keep working. Otherwise, what the docs do describe is turning 2FA off from Settings while you can still sign in, after which you can set it up again on the new phone. Do this before you wipe or hand over the old one. See How to transfer your authenticator app to a new iPhone.
Turning 2FA off
On the Settings page, open the Disable 2FA window, enter a current 6-digit code and your password, and select Disable (Report URI). Report URI warns that this isn't advised. If a team you belong to requires 2FA, you lose access to that team's data until you turn it back on.
Requiring 2FA for a team
A team owner can select Enable 2FA Requirement under Require 2FA on the Teams page, while switched into that team. It's set per team (Report URI).
