Skip to content
Novaz AuthenticatorGET

Salesforce 2FA (MFA): how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. First: admins now need a passkey
  2. Connect Novaz from your settings
  3. Or set it up at login
  4. When Salesforce asks for a code
  5. No backup codes
  6. If Salesforce rejects your code
  7. Changing phones or removing Novaz
  8. If you lose your authenticator
  9. Official Salesforce help

If you log in to your company's Salesforce org with a username and password, Salesforce requires a second step, which it calls multi-factor authentication (MFA). It has been in Salesforce's contract since February 1, 2022 (Salesforce) and covers all internal users (Salesforce). The options are Salesforce Authenticator, a third-party authenticator app, a security key, or a built-in authenticator such as Face ID or Windows Hello (Salesforce). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Salesforce steps come from Salesforce's own help articles and its Trailhead training, linked below, which we read on October 20, 2026. We haven't tested them in a Salesforce org, and your company's settings can change what you see, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

First: admins now need a passkey

Between July 20 and September 3, 2026, Salesforce switched production orgs to phishing-resistant MFA for privileged users: anyone with the System Administrator profile, or the Modify All Data, View All Data, Customize Application or Author Apex permission, even through a permission set. They now need a security key or a built-in authenticator. Authenticator apps, Salesforce Authenticator included, don't count for them (Salesforce). Everyone else can still use an authenticator app (Salesforce), so this guide is for them.

Connect Novaz from your settings

If you can already log in, add Novaz from your personal settings (Salesforce):

  1. Click your profile picture, then Settings (Salesforce).
  2. In the Quick Find box, enter Advanced User Details and select Advanced User Details. If nothing comes up, search for Personal Information instead.
  3. Next to App Registration: One-Time Password Authenticator, click Connect.
  4. Salesforce checks that it's you, for example by emailing you a code.
  5. Salesforce shows a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. Can't scan it? Click I Can't Scan the QR Code to see a key. In Novaz, tap +, then Enter key manually. Enter Salesforce as the Service, your Salesforce username as the Account, and the key as the Setup key. See What is a 2FA setup key?
  7. Type the current code from Novaz in Verification Code and click Connect.

Typing the key works fine in Novaz: Salesforce's codes have 6 digits and change every 30 seconds (Salesforce). Salesforce emails you whenever a new verification method is added to your account.

Or set it up at login

With nothing registered yet, you'll be asked to pick a method at login (Salesforce):

  1. Log in from a desktop browser. On Choose a Verification Method, select Use verification codes from an authenticator app (such as Google Authenticator or Authy) and click Continue. If Salesforce opens another method first, click Choose Another Verification Method at the bottom.
  2. On Connect an Authenticator App, scan the QR code with Novaz, or click I Can't Scan the QR Code and type the string from the Key field into Novaz.
  3. Enter the 6-digit code in Verification Code and click Connect.

If an option is missing, ask your System Administrator.

When Salesforce asks for a code

At every login (Salesforce). Type the code from Novaz and click Verify. Admins can also require it for some reports, dashboards or connected apps. With single sign-on, your company's identity provider may handle it instead (Salesforce).

No backup codes

The Salesforce pages we read don't mention backup codes. Your fallbacks are a second method, such as a security key (Salesforce), or your admin. Unless you back up Novaz (iCloud backup or a backup file), its keys exist only on your iPhone, so if your org allows a second method, add one.

If Salesforce rejects your code

The error is Invalid or expired verification code. Salesforce says to make sure you're typing the current code and to check that your phone's clock matches your computer and time.gov (Salesforce). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off.

Don't keep guessing: too many wrong codes lock you out for about an hour (Salesforce). More in Authenticator code not working?

Changing phones or removing Novaz

You can't register a new method of the same type until the old one is removed (Salesforce). While you can still log in, open Advanced User Details and click Disconnect or Remove next to the authenticator app, and Salesforce asks you to register again at your next login (Salesforce). If you can't log in, your admin has to do it. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep using the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Ask your company's Salesforce admin, not Salesforce. The admin disconnects the lost method and gives you a temporary verification code, valid for 1 to 24 hours, so you can log in and register Novaz on your new phone. Salesforce doesn't send this code: the admin passes it on, then expires it (Salesforce, Salesforce). Salesforce doesn't say what proof your admin should ask for.

If you're the org's only admin and you're locked out, Salesforce says to contact Salesforce Customer Support (Salesforce). More in Lost the phone with your authenticator app?

Official Salesforce help

More guides: Marketing and sales