RevenueCat 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your RevenueCat account is the dashboard login for an app's subscriptions, paywalls and revenue charts, often shared with teammates. Two-factor authentication (2FA) is optional, though a project's owner or administrators can require it before you join their project. RevenueCat documents one method: an authenticator app, backed by recovery codes (RevenueCat).
Plan for recovery first. If you lose both the app and your recovery codes, RevenueCat warns that "RevenueCat Support may not be able to restore access" (RevenueCat). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the RevenueCat steps come from RevenueCat's own documentation, including its screenshots, linked below, which we read on October 20, 2026. We haven't tested them on a RevenueCat account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
RevenueCat's docs and screenshots show these steps (RevenueCat):
- In the RevenueCat dashboard, open Account > Security.
- Under Two-factor Authentication, click Set up.
- Type your password again when RevenueCat asks for it.
- The Set up two-factor authentication window shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the dashboard is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Can't scan? The same window shows a secret code with a copy button. In Novaz, tap +, then Enter key manually, and paste it as the Setup key, with RevenueCat as the Service. See What is a 2FA setup key?
- Type the code Novaz shows into the Two-factor code box and click Enable.
- Save the recovery codes RevenueCat shows next. This is your only chance to see them.
RevenueCat doesn't say how many digits its codes have or how often they change. Scanning is safer, because the QR code passes those settings to Novaz; a typed key always gets 6 digits every 30 seconds.
Your recovery codes are the backup
RevenueCat says you need these codes whenever you lose access to your authenticator app, a new phone included (RevenueCat). Its docs note that some apps keep their own backups. Novaz can, if you turn on iCloud backup or export a backup file; without one, its keys stay on your iPhone and the recovery codes are your way back in. Store them in a password manager or on paper.
RevenueCat's screenshot of the Security page shows a Recovery codes available row with a count (5 / 5 in the example) and a Regenerate button. The page's text doesn't explain them. More in 2FA backup codes.
When RevenueCat asks for a code
Once 2FA is on, you need a code from your app every time you log in to your RevenueCat account (RevenueCat). The docs don't mention remembering a trusted browser.
On an Enterprise plan with single sign-on (SSO), everyone with the company's email domain signs in through the company's identity provider (RevenueCat). RevenueCat's SSO page doesn't say whether its own two-factor step still applies then.
Requiring 2FA for your team
On Project settings > Collaborators, a Two-factor column shows who has it on. Owners and administrators who use 2FA themselves can tick Require two-factor authentication for your team. New collaborators then can't join until they've set it up (RevenueCat, RevenueCat).
The catch: you can only turn the requirement on once every current collaborator already uses 2FA. RevenueCat's workaround is to remove anyone who doesn't and invite them again.
If RevenueCat rejects your code
RevenueCat gives no advice for rejected codes. Usually the iPhone's clock is off. Open Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?
Changing phones
RevenueCat doesn't document moving 2FA to a new phone; it treats a new phone as a reason to use recovery codes. With a Novaz iCloud backup or backup file, you can restore RevenueCat on the new iPhone. Without one, keep the old phone and your unused codes until RevenueCat works on the new one. If you plan to turn 2FA off and on again, collaborators on a project that requires it must leave that project first. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with one of your recovery codes. Without them, you may be locked out for good: RevenueCat doesn't promise that Support can get you back in, and describes no other way to verify yourself (RevenueCat).
If the locked-out person owned a project, the team can ask Support for an ownership review. Support checks that you're entitled to the project, for example with a temporary DNS record on the company's domain, then moves it to another account. That process covers the project, not the owner's locked account. Support doesn't need the owner's recovery codes, so don't send them (RevenueCat).
More in Lost the phone with your authenticator app?
Turning 2FA off
Open Account > Security and click Disable under Two-factor Authentication. If you're a collaborator on a project that requires 2FA, you have to leave that project first (RevenueCat). After that, open RevenueCat in Novaz and tap Remove account.
