SAPO Mail 2FA: how to set up an authenticator app in SAPO ID

SAPO Mail, the Portuguese webmail at mail.sapo.pt, signs you in through SAPO ID, the one account behind SAPO's services. So optional two-step authentication (autenticação em dois passos) is set up in SAPO ID, with a text message, an authenticator app (TOTP) or a YubiKey as the second step (SAPO). It doesn't protect IMAP or POP access, and SAPO's help documents no backup codes, so read those sections first.

This guide uses Authenticator App - Novaz on iPhone; any authenticator app works the same way. SAPO's pages are in Portuguese, so we give its labels with an English meaning in parentheses.

How we checked this guide: the SAPO steps come from Ajuda SAPO, SAPO's own help site, linked below. ajuda.sapo.pt didn't answer our automated reader, so on October 20, 2026 we read the pages as archived copies on web.archive.org. The SAPO ID page, which the Help link on id.sapo.pt opens, was saved on October 15, 2026. We haven't tested the steps on a SAPO account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start

SAPO ID needs two things first (SAPO):

• A password. Sign-in without a password isn't allowed with two-step authentication on. SAPO Mail accounts always use one anyway.
• A recovery contact. Add an email address or phone number on the Dados de recuperação (Recovery data) page and confirm it with the code SAPO sends. SAPO Mail addresses don't get one automatically.

Turn on 2FA with an authenticator app

SAPO's help covers the setup briefly (SAPO):

1. Sign in at id.sapo.pt with your SAPO Mail address and password.
2. Open the Segurança (Security) page.
3. Under Autenticação em dois passos (Two-step authentication), choose the option the help calls Adicionar Google Authenticator ou TOTP (Add Google Authenticator or TOTP).
4. Set a profile name for your authenticator. The setup window shows a QR code; the help also mentions a key (chave) but not where it appears.
5. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
6. Finish in the window. The help doesn't say whether it asks for a first code.

SAPO's codes last 30 seconds, the same as Novaz uses for a typed key. The help doesn't give the code length, so scan if you can. To type the key instead, tap +, then Enter key manually, and paste it into Setup key. See What is a 2FA setup key?

Block IMAP and POP

Mail programs such as Outlook use IMAP or POP, which can't ask for a second step, so those connections rely on your password alone. SAPO recommends blocking them: at mail.sapo.pt, open Definições (Settings), the Segurança (Security) tab, and turn on Bloquear IMAP/POP (Block IMAP/POP) (SAPO).

IMAP is now a Premium feature; free Base accounts lost it (SAPO). On Premium, blocking it stops your mail app from working.

If SAPO rejects your code

After your password, SAPO asks for the code in an extra verification window; the help doesn't mention trusted devices. Take longer than 30 seconds and you need a fresh code (SAPO), so wait for the next one in Novaz.

If codes keep failing, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

No backup codes

SAPO's help mentions no backup codes. It tells you to back up your authenticator app and not to delete it before turning the method off in SAPO ID, warning that losing the profile in the app may mean you "perder o acesso à sua conta SAPO" (lose access to your SAPO account) (SAPO).

In Novaz, that backup is iCloud backup (PRO) or an exported backup file, both under Settings › Backup. SAPO doesn't say whether you can keep a text message or YubiKey active as well. If your Segurança page lets you, that's your fallback.

Changing phones

While the old phone still works, turn off the authenticator method in SAPO ID, then add it again with the new phone. The help doesn't show the button. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

SAPO's help describes no way past the second step without your app. What it does say:

• If a lost device was signed in, Gerir sessões (Manage sessions) on the Segurança page closes every active session (SAPO).
• Password recovery is fully automatic: SAPO's team can't change recovery contacts and doesn't look at ID documents (SAPO). The help doesn't say if that applies to two-step authentication.
• Support is at apoioportalsapo@suporte.sapo.pt (SAPO), and SAPO Mail has a phone line, 16200 (SAPO). The help doesn't say what support can do here.

More in Lost the phone with your authenticator app?

Official SAPO help

• SAPO ID (in Portuguese; read in an archived copy from October 15, 2026)
• Esqueci-me da senha do meu SAPO Mail. O que fazer? (Forgot your SAPO Mail password; archived copy from August 30, 2026)
• Não consigo consultar o meu correio no Outlook/telemóvel (Can't read mail in Outlook or on a phone; archived copy from August 30, 2026)
• Contactos (Contacts; archived copy from September 27, 2026)