ServerPilot 2FA: how to set up an authenticator app

ServerPilot is a control panel for running PHP and WordPress apps on your own cloud servers, so the account behind it can reach every server and app you've connected. Two-factor authentication (2FA) has been available since December 2016 (ServerPilot). It isn't required, but ServerPilot's account setup page recommends turning it on and names two kinds of tools that work: an authenticator app such as Google Authenticator, or a password manager that can hold 2FA codes, such as 1Password (ServerPilot).

That paragraph is nearly all ServerPilot documents about 2FA. Its pages don't describe the setup screens, backup codes or recovery, and this guide says so wherever that leaves a gap. The steps use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the ServerPilot details come from ServerPilot's own documentation, blog and contact page, linked below, which we read on October 22, 2026. We haven't tested them on a ServerPilot account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Where the setting is

ServerPilot's docs link straight to the page in your account: the 2FA settings page at manage.serverpilot.io/account/2stepauth (ServerPilot). You have to be signed in to the ServerPilot dashboard to open it. The older docs address for the 2FA instructions now forwards to that same account setup page.

Turn on 2FA with an authenticator app

1. Sign in to ServerPilot at manage.serverpilot.io, the dashboard behind the Log in link on serverpilot.io.
2. Open your account's 2FA settings (manage.serverpilot.io/account/2stepauth).
3. Follow the prompts on that page. ServerPilot doesn't document the screens, so the labels you see are the ones to trust.
4. If the page shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. If you get a text key instead, tap +, then Enter key manually in Novaz. Fill in Service (for example, ServerPilot), Account if you like, and paste the key as the Setup key. See What is a 2FA setup key?
6. Type the current code from Novaz back into ServerPilot to finish, if it asks for one.

ServerPilot doesn't say how long its codes are or how often they change. Scanning the QR code is the safer route, because the code carries those settings to your app. A key typed by hand in Novaz always makes 6-digit codes every 30 seconds.

Password manager or authenticator app

ServerPilot leans toward password managers. Its security best practices page says modern password managers can store and auto-fill 2FA codes, and it recommends one (ServerPilot). ServerPilot doesn't warn against keeping the 2FA code in the same password manager as your ServerPilot password. Keeping them apart, with the password in a password manager and the code in Novaz, means one compromised vault doesn't hand over both.

Plan for a lost phone before you need to

The same best practices page asks you to make sure you won't lose your 2FA credentials if you lose your device (ServerPilot). With Novaz, that means turning on iCloud backup (PRO) or exporting a backup file in Settings › Backup; without one, its keys exist only on your iPhone.

ServerPilot's docs don't mention backup or recovery codes. If the setup page offers any, save them away from your phone. If it shows a setup key, you can also keep a copy of that key somewhere safe, such as a password manager or a printed sheet in a locked drawer, so you can add ServerPilot to a new app later. Treat that key like a password. More in 2FA backup codes.

If ServerPilot rejects your code

ServerPilot gives no advice on rejected codes. The most common cause is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also make sure you're reading the ServerPilot entry and not a different account. Other causes are in Authenticator code not working?

Changing phones

With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone. Without one, you'll set ServerPilot up again on the new phone. ServerPilot doesn't document how to replace an authenticator. While you can still sign in with the old phone, open the 2FA settings page and see what it offers. If you saved the setup key, you can add it to Novaz on the new iPhone with Enter key manually. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Start with any backup codes or saved setup key you have. Without them, ServerPilot's docs describe no self-service recovery. The contact route it publishes is email to support@serverpilot.io, and signed-in customers can also use a support form in the dashboard (ServerPilot). If you're locked out, email is the one you can still use. ServerPilot doesn't say what proof it asks for or how long a 2FA reset takes, so write from the email address on your account. See Lost the phone with your authenticator app?

Official ServerPilot help

• Set up your ServerPilot account (section "Enable 2FA")
• Best practices for server and app security
• Introducing two-factor authentication
• Contact