Roberts Space Industries 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Roberts Space Industries (RSI) account is the one behind Star Citizen: the RSI website, Spectrum, the RSI Launcher and your pledges. Unlike most accounts, it can't go without two-factor authentication (2FA). Every RSI account has it, and it starts out as codes sent to your registered email address (RSI). RSI also notes that its system turns email codes back on by itself if they were switched off and it sees unusual sign-in activity (RSI).
So the real choice is email codes or an authenticator app, which RSI calls the stronger option. This guide uses Authenticator App - Novaz on iPhone. RSI's instructions name Google Authenticator and Authy, but any authenticator app that makes time-based codes, Novaz included, works the same way.
How we checked this guide: the RSI steps come from the RSI support center, linked below, which we read on October 21, 2026. We haven't tested them on an RSI account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
RSI describes these steps on the website, not in the Launcher (RSI):
- Sign in at robertsspaceindustries.com.
- Click your Account Icon in the upper right and choose Account Dashboard.
- Click Settings, then the Security tab on the left. RSI asks you to verify yourself again here. One page says with a 2FA code, another says you may need your password, so expect either.
- In the Security Management section, select Two-Factor Authentication (2FA).
- Choose Mobile Method. RSI shows a QR code and, separately, an alphanumeric code you can type instead.
- In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the page is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, tap +, then Enter key manually in Novaz, and type the alphanumeric code as the Setup key. See What is a 2FA setup key?
- Back on the RSI page, click NEXT and type the current code from Novaz.
A notification in the upper right then confirms the change. RSI's pages don't say how many digits its codes have or how often they change, so scanning the QR code is the safer route: it carries those settings to the app.
Generate your backup codes next
RSI doesn't hand you backup codes during setup. You make them afterwards: go back to Security Management in your account settings and select Backup Codes (RSI). You can generate up to 10, and RSI says they don't expire (RSI, RSI).
Keep them away from your phone and outside your RSI account. If that iPhone is gone and you have no Novaz backup (iCloud backup or a backup file), or it's older than this account, these codes are what gets you back in. See 2FA backup codes.
Choosing how long a sign-in lasts
When you enter a code, RSI lets you pick how long that device stays trusted: Single Session, 1 Month or 1 Year (RSI). The choice is stored in a browser cookie. When it expires, or when you clear your cookies, you're asked for a code again. If you block cookies on the RSI site, you'll be asked every time.
RSI also says the current site design doesn't preselect a duration. If your password and code are right but sign-in still fails, pick a duration and try again (RSI).
If RSI rejects your code
RSI's troubleshooting page gives two reasons for an "invalid or already used" message (RSI):
- The app is no longer linked. If the authenticator was removed from your account, or the account was switched back to email codes, the old entry in your app makes useless codes. Delete it and set the account up again.
- The phone's clock is wrong. On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.
Two more checks from the same page: sign-in on a phone or tablet can fail, so RSI suggests a desktop computer, and if the code works on the website but not in the Launcher, it recommends clearing the Launcher's Local Storage and Cache folders. More causes are in Authenticator code not working?
Changing phones
RSI is firm about the order: remove the authenticator from your account before you switch phones, change apps or reinstall the app. A new or reinstalled app doesn't have the shared secret, so its codes won't match (RSI).
To remove it, go to Account Dashboard > Settings > Security, find Two-Factor Authentication, and click the red X icon. Then set it up again on the new phone with the steps above. Novaz gives you another way: restore your accounts on the new iPhone from iCloud backup or a backup file, and the restored app has the same secret, so its codes still match. Without a Novaz backup, follow RSI's order. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with one of your backup codes, remove the old authenticator on the Security tab, and add a new one (RSI).
Without backup codes, you'll need to open a ticket with RSI support. The RSI Player Relations team asks for as much of this as you can give (RSI):
- the last email address you used on the account, your handle, and your Login ID if you set one,
- your date of birth and the first and last name on the account,
- the first line of your billing address,
- details of your pledges, ideally order IDs.
RSI doesn't say how long recovery takes. See also Lost the phone with your authenticator app?
Can you turn 2FA off?
Not completely. RSI's answer is no: every account needs some form of 2FA (RSI). Removing the authenticator app is possible, and email codes are the remaining option. In Novaz, open the account and tap Remove account only after RSI no longer uses it.
