Resend 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Resend is an email platform for developers: your login manages sending domains, API keys and your team. Resend calls its second sign-in step multi-factor authentication (MFA), and the only method its help describes is an authenticator app (Resend). It's optional and set up per person, so a team admin can't require it. Two details set Resend apart: you get just one recovery code, and if you lose both your phone and that code, you prove who you are with a DNS record on one of your domains. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Resend steps come from Resend's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a Resend account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Resend's help gives these steps (Resend):
- Sign in to Resend and open your Profile page (resend.com/profile).
- Click Enable MFA.
- Resend shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code Novaz shows into Resend.
- Resend shows your recovery code. Copy it, store it, then click I've saved my recovery code.
Resend's help doesn't mention a text key or how many digits its codes have, so scan the QR code: it carries the code settings to your app. If you do see a key and type it with Enter key manually, see What is a 2FA setup key?
Your one recovery code
Most services hand out a list of backup codes. Resend gives you a single code, ten characters with a dash in the middle (XXXXX-XXXXX), and shows it only once, when you turn MFA on (Resend). Using it doesn't just get you in: it turns MFA off, signs out your other sessions and emails you a notice. You then set MFA up again and get a new code.
Resend suggests keeping the code somewhere other than the phone that makes your codes, such as a password manager. With Novaz this matters if you haven't turned on iCloud backup or exported a backup file, because then the keys exist only on your iPhone and the recovery code is your way back in. See 2FA backup codes.
If you turned on MFA before October 8, 2026, when Resend added recovery codes, you don't have one yet. Resend says to make one from your Profile page while you can still sign in (Resend). Its help doesn't name the button.
When Resend asks for a code
Once MFA is on, Resend asks for a code from your app each time you sign in. Its help doesn't mention trusted devices, and doesn't say whether the code is asked when you sign in with Google or GitHub. If your team has Enforce SSO turned on, your company's identity provider handles sign-in instead (Resend).
On a team, anyone can see who has MFA on in the Enabled MFA column of Team Settings (Resend). But no one else, not even an admin, can reset yours.
If Resend rejects your code
Resend's own advice is short: make sure you're reading the entry your app created for Resend, not one for another service, and set your phone's clock to update automatically (Resend). On iPhone, that's Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Changing phones
While you can still sign in, go to your Profile page, click Revoke Access, then Enable MFA again and scan the new QR code with your new phone. Save the new recovery code it gives you (Resend). Keep the old phone until this is done. If you have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead and skip the reset. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in as usual and enter your recovery code where Resend asks for the authenticator code. MFA is switched off and you're signed in. Turn it on again with your new phone. If Resend later emails you "Your Resend two-factor authentication was reset" and you didn't do it, reset your password and contact support right away (Resend).
Without the recovery code, a password reset won't help: Resend still asks for the authenticator code afterwards. Support can remove MFA once you prove you own a domain on the account (Resend):
- Contact support from resend.com/help. Include the email address you sign in with and a domain that's on the account.
- Support replies with a verification value made for your request. Add it as a
TXTrecord on that domain, with the host exactlyverification. - Reply to support and name the domain where you added the record.
If your account has no domains, support will verify you another way. Resend doesn't say how long this takes. If you've also lost the email address you sign in with, see Resend's article on recovering team access. More in Lost the phone with your authenticator app?
Turning 2FA off
On your Profile page, click Revoke Access. After that, you sign in with your email and password alone (Resend). Resend's help doesn't say whether it asks for a code first. Remove the entry from Novaz afterwards: open it and tap Remove account.
