RIPE NCC 2FA: how to set up an authenticator app for RIPE NCC Access

RIPE NCC Access is the single sign-on account for RIPE NCC services such as the LIR Portal, RIPE Database updates and the RPKI dashboard (RIPE NCC). Two-factor authentication (2FA) isn't optional: it has been mandatory for every account since March 27, 2024 (RIPE NCC).

You can use an authenticator app or, since May 2024, a passkey on a security key or in a password manager (RIPE NCC). This guide covers the app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the RIPE NCC steps come from the RIPE NCC's own help pages, policy and announcements, and from posts by its staff on its forum and mailing lists, linked below, which we read on October 19, 2026. We haven't tested them on a RIPE NCC Access account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Setup starts in your inbox

There's no 2FA switch to look for. If your account doesn't have 2FA yet, trying to log in starts the setup: the RIPE NCC emails you a setup link, which stops working one hour after it's sent (RIPE NCC).

The email goes to your account's address, which only the RIPE NCC can change (RIPE NCC). If you no longer read that mailbox, contact the RIPE NCC first.

Turn on 2FA with an authenticator app

The RIPE NCC's help page describes these steps (RIPE NCC):

1. Try to log in to RIPE NCC Access, then click the link in the RIPE NCC's email.
2. Under Choose a 2FA method, pick Authenticator app.
3. The setup screen shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and tap +, then Choose a photo. See scanning a QR code on the same iPhone.
4. If you can't scan it, the screen also offers a secret key. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?
5. Type the code from Novaz on the setup page, and give the authenticator a device name.
6. Print, download or copy the recovery codes. Tick the box confirming you've saved them, then click activate.

The RIPE NCC's policy describes standard time-based codes (TOTP), the kind Novaz makes (RIPE NCC). The pages don't say how many digits the codes have or how often they change, so scan the QR code if you can: it carries those settings to the app.

Save the recovery codes somewhere else

The RIPE NCC says you'll need these codes if you delete the authenticator app, your phone's battery is dead, you lose the phone, or you can't make a code for any other reason (RIPE NCC). Its pages don't say how many codes you get, whether each works once, or how to make new ones.

Keep them even if you back up Novaz: they get you in if the phone is gone and you have no Novaz backup, or the backup is older than this account. Store them in a password manager or on paper, away from your phone. See 2FA backup codes.

When you'll need a code

Each time you log in, you'll need your password and a code from the app (RIPE NCC). That applies wherever you use RIPE NCC Access, including the RIPE NCC Forum, as RIPE NCC staff confirmed in a forum post (RIPE NCC).

If the RIPE NCC rejects your code

The RIPE NCC's pages don't cover this. Its codes depend on the current time (RIPE NCC), so check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

The RIPE NCC's pages don't explain how to move your authenticator to a new phone or add a second one. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and keep using the same codes. Without one, before you wipe the old phone, make sure you have your recovery codes, or ask the RIPE NCC how to switch. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

A RIPE NCC staff member described the route on the RIPE Atlas mailing list in March 2025 (RIPE NCC):

• On the login form, choose try another way and enter one of your recovery codes.
• If you don't have them, send a request through the RIPE NCC contact form.

When 2FA became mandatory, the RIPE NCC also asked anyone having trouble with setup to email ncc@ripe.net (RIPE NCC). Its pages don't say what proof it asks for to reset 2FA or how long that takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

It's mandatory, so the RIPE NCC's pages describe no way to switch it off.

Official RIPE NCC help

• Two-Factor Authentication
• RIPE NCC Access (Single Sign-on)
• RIPE NCC Access SSO Account Authentication and Security Key Management Policy
• Mandatory 2FA on RIPE NCC Access Accounts
• Two-Factor Authentication Using Passkeys
• The LIR Portal
• 2FA Mandatory on RIPE NCC Access accounts (announcement, March 2024)
• RIPE Atlas UI: Revamped Probe Detail Pages released (staff reply, March 2025)
• 2FA now mandatory for RIPE NCC Access account users (staff forum post)