Scryfall 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
You only need a Scryfall account for the personal parts of the Magic: The Gathering card search site, such as your decks and search settings. The account has no password: every time you sign in, Scryfall emails you a one-time link (Scryfall).
Two-factor authentication (2FA) is an optional extra on top of that link. Once it's on, Scryfall asks for "a secondary passcode from an app each time you sign in" (Scryfall). That's the only second method Scryfall describes: its pages don't mention text messages, security keys or backup codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Scryfall steps come from Scryfall's own Privacy and Security page and site FAQ, linked below, which we read on October 20, 2026. Scryfall's contact page blocked automated access, so we read it in an archived copy from February 2025 on web.archive.org. We haven't tested anything on a Scryfall account, and Scryfall's public pages don't show the setup screen itself, so the steps stop where its documentation does. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
- Go to scryfall.com/signin, enter your email address, and open the link Scryfall sends you. It only works on the device you're signing in on (Scryfall).
- Open the site menu, choose Your Account…, then Email & Security. This is scryfall.com/settings/security, the same page the Set up two-factor authentication button on Scryfall's privacy page opens (Scryfall).
- Start the two-factor setup on that page. Scryfall doesn't publish the labels or screenshots for this step, and doesn't say whether it shows a QR code, a text key or both, so follow what the page shows.
- If Scryfall shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you only get a text key, tap +, then Enter key manually. Type Scryfall as the Service, your email as the Account if you like, and the key as the Setup key. See What is a 2FA setup key?
- If Scryfall asks you to confirm with a code, type the one Novaz is showing right now.
A key typed by hand always gives 6-digit codes that change every 30 seconds. Scryfall doesn't say what its codes look like, so scan the QR code whenever you can: it carries the right settings to the app.
Scryfall may email you when account settings change or when you sign in (Scryfall), so expect a notice. One you didn't cause is worth a look.
Your inbox is still half of the lock
Without a password, your email does the job a password does elsewhere. Scryfall also confirms sensitive account tasks with a one-use email link, and the option to change your account email sits on the same Email & Security page (Scryfall). With 2FA on, someone would need both your inbox and your phone, so protect your email account well too.
No backup codes are mentioned
Scryfall's pages say nothing about backup or recovery codes. If the setup screen offers some, keep them away from your phone, in a password manager or on paper. They'd be your way back in if the phone is gone and you have no Novaz backup.
When Scryfall asks for a code
It asks every time you sign in. Scryfall doesn't mention remembered devices, or say whether the code comes before or after the email link. Clearing your cookies signs you out, so expect both steps again afterwards.
If Scryfall rejects your code
Scryfall has no advice for rejected app codes. Its sign-in help only covers email links that fail: delete old Scryfall emails, add accounts@scryfall.com to your contacts, wait an hour, then request a new link (Scryfall).
For the app code, check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones or turning 2FA off
Scryfall documents neither. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone. Without one, switch while you still have the old phone: look on Email & Security for a way to set the authenticator up again, and if there isn't one, ask Scryfall before you reset the old phone. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Scryfall doesn't publish a recovery process for two-factor authentication. The way to reach the team is its contact form, which has a topic called I’m having a problem with my account (Scryfall, archived copy). On that form the email field is optional, so fill it in, or Scryfall can't reply to you. Give your username and the email address on the account, the two details every Scryfall account has (Scryfall). Scryfall doesn't say what proof it asks for or how long a reset takes.
More in Lost the phone with your authenticator app?
