Short.io 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Short.io is a link shortener that businesses use for branded short links on their own domains, often from a shared team account. For two-factor authentication (2FA), Short.io relies on authenticator apps only. Its help pages don't mention text-message codes, email codes or backup codes (Short.io).
For most people 2FA is optional. The exception is teams: an owner can make it a condition of team membership, and members without it get removed from the team (more on that below). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Short.io steps come from Short.io's own help pages, linked below, including their screenshots, which we read on October 21, 2026. We haven't tested them on a Short.io account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Short.io's help describes these steps (Short.io):
- Sign in to Short.io on a computer.
- In the left menu, open Settings, then click Profile.
- Choose Security.
- Under Two-factor authentication, switch on the Two-factor authentication toggle. A QR code appears, under the heading Scan this QR code with 2FA application.
- In Novaz, tap +, then Scan QR code, and point the camera at the code on your screen.
- Type the 6-digit code from Novaz into Enter the code from your authenticator.
- Click Enable.
The screenshots in Short.io's help show only the QR code. They don't show a text key you could type in by hand, and the page doesn't mention one. So plan to scan the code. If the QR code is on the same iPhone as Novaz, take a screenshot, tap + in Novaz, then Choose a photo. See scanning a QR code on the same iPhone.
Signing in afterwards
Once 2FA is on, signing in with your email and password brings up a Two-factor authentication box. Type the current code from Novaz into Authentication code and click Verify (Short.io).
The sign-in page in Short.io's screenshot also has buttons for Google, Facebook, Apple and SSO, and you can add a passkey (Short.io, Short.io). Its help only describes the code prompt for email and password sign-in. It doesn't say whether those other methods ask for a code too.
When a team requires 2FA
A team owner can click Enforce 2FA under Settings > Teams (Short.io). What happens next depends on the team:
- Members who haven't set up 2FA are taken off the team. Their status changes to Invite pending, and Short.io emails them a link to turn on 2FA.
- New members can't be added unless 2FA is already on in their own profile.
If you've been dropped this way, set up 2FA using the steps above, then follow the link in the email. The owner can lift the rule with Disable 2FA.
No backup codes
Short.io's help doesn't mention backup or recovery codes, a second method, or a way to move 2FA to a new phone. That matters with Novaz, because its keys exist only on your iPhone unless you turn on iCloud backup or export a backup file. Without one, if that iPhone is lost, nothing in Novaz can bring the Short.io code back.
Two things help. First, if you can, add a passkey as well, in the Passkeys section of the same Security tab (Short.io). Short.io doesn't say whether a passkey gets you past a lost authenticator, so don't count on it. Second, keep the address for Short.io Support (below) somewhere you can find it.
If Short.io rejects your code
Short.io's help doesn't cover rejected codes. The usual cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Short.io doesn't document moving 2FA to a new phone. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and the code keeps working. Without one, keep the old iPhone until Short.io is set up on the new one, and ask Short.io Support if you can't find a way to redo the setup yourself. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Short.io's help doesn't describe a recovery process for a lost authenticator, what proof it asks for, or how long it takes. The route it gives for account problems is Short.io Support: the chat bubble on its pages, or email to support@short.io (Short.io). Support works in English, 24 hours a day, Monday to Friday, with no phone line, and replies can be slower on holidays (Short.io). Write from the email address on your account.
More in Lost the phone with your authenticator app?
Turning 2FA off
Short.io's help doesn't explain how to turn off 2FA for your own profile. The only off switch it documents is Disable 2FA, which lifts a team's rule but doesn't touch anyone's own setup (Short.io). Before removing Short.io from Novaz, check in Settings > Profile > Security that the toggle is really off.
