Rewind 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Rewind is the backup service many teams use to protect data in apps like Jira, Confluence, Shopify and Klaviyo. Since June 1, 2026, multi-factor authentication (MFA) is mandatory on every Rewind account. You don't have to set anything up for that: by default, Rewind emails you a 6-digit code each time you sign in (Rewind).
Rewind also supports a TOTP authenticator app and FIDO2/WebAuthn security keys, and recommends the app for most teams, especially admins (Rewind). This guide moves your account from email codes to an app. We use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Rewind steps come from Rewind's own help center and blog, linked below, which we read on October 22, 2026. The help center blocks automated visits and no archived copy could be reached that day, so we read its articles through the help center's public article feed on Rewind's own domain. We haven't tested the steps on a Rewind account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Rewind's blog post, last updated in October 2026, describes these steps (Rewind):
- Sign in to Rewind at app.rewind.com, using the email code one last time.
- Click your profile icon, open Settings, and choose Security in the menu on the left.
- Under the MFA card, select Set Up, then type your Rewind password to confirm.
- Rewind shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Type the 6-digit code that Novaz shows to finish the connection.
- Save the backup codes Rewind shows next (see below).
The help center article uses slightly different labels: it calls the page Account Settings > Security and puts the Set up button under Authenticator App (Rewind).
Neither page mentions a text key you could type instead of scanning, so plan to scan the QR code. If Rewind does offer a key, add it in Novaz with + and Enter key manually, as the Setup key (What is a 2FA setup key?). Rewind's codes are 6 digits and change every 30 seconds, which matches what Novaz makes from a typed key.
Save your backup codes
Rewind displays MFA backup codes once setup is complete, and you can use them to get in if you lose access to your app (Rewind). Keep them outside your phone, in a password manager or on paper. If you lose the phone and have no Novaz backup (iCloud backup or a backup file), these codes are your way back in. Rewind's pages don't say how many codes you get or how to make new ones. More in 2FA backup codes.
What sign-in looks like afterwards
Once the app is set up, Rewind asks for a code from it at every sign-in, and the email code is no longer used. If you also register a security key, Rewind asks for the key first. To use Novaz instead, pick the option to switch at the bottom of the sign-in screen (Rewind).
Rewind's changelog notes that organizations have been able to enforce 2FA for their members since June 2025 (Rewind).
If Rewind rejects your code
Rewind's help doesn't cover rejected app codes. The usual cause is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Rewind doesn't describe moving the app to a new phone. What it does document is turning the app off, which drops you back to email codes, and setting a method up again from Settings > Security (Rewind). So while you still have the old iPhone, turn the app off, then add Rewind to Novaz on the new one with the steps above. If you keep a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with a backup code, then set up the app again. Without one, contact Rewind Support at help@rewind.com or through the request form in the help center (Rewind). When you can still sign in, Support checks who you are with a time-limited Support PIN from the Security tab. If you're locked out, Rewind only says to contact Support. It doesn't say what proof it asks for or how long recovery takes. See also Lost the phone with your authenticator app?
Turning the authenticator app off
On Account Settings > Security, under Authenticator App, select Update. Confirm with your password and either a code from Novaz or a backup code, then select Yes, disable. Your account goes back to email codes unless a security key is still registered (Rewind).
You can't switch MFA off completely yourself: Rewind's security team must review and approve a request sent to Support. Once Rewind has confirmed the app is off, open the account in Novaz and tap Remove account.
