Shortcut 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Shortcut is the project management tool many software teams use for stories, epics, iterations and roadmaps. Its two-factor authentication (2FA) works with an authenticator app, and the help page doesn't list any other method, such as text messages. Shortcut doesn't make 2FA mandatory, but it encourages everyone in an organization to use either 2FA or Google sign-in (Shortcut). Two details set it apart: you get a single recovery code rather than a list, and if you lose that code, you can't ask Support for help yourself. Someone with Owner or Admin permissions in your organization has to.
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Shortcut steps come from Shortcut's own help center, linked below, which we read on October 21, 2026. We haven't tested them on a Shortcut account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Signing in with Google? Read this first
If you sign in to Shortcut with Google, Shortcut won't ask you for a 2FA code. Your protection then comes from 2-Step Verification on your Google Account instead (Shortcut).
You can still add Shortcut's own 2FA on top of Google sign-in. Shortcut says you may need to set a password on your Shortcut account first, because the setup asks for it.
If your company signs you in through SAML single sign-on, your identity provider handles the sign-in (Shortcut). Shortcut's 2FA page doesn't say how its own 2FA fits with SSO.
Turn on 2FA with an authenticator app
Shortcut's help center gives these steps (Shortcut):
- Select your profile icon or photo.
- Select Settings.
- Under Your Account, select Security.
- Select Two-Factor Auth.
- Type your Shortcut password again when asked, then press Continue.
- Shortcut shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the iPhone you're holding, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the code from Novaz and select Confirm.
- Copy your Recovery Code and put it somewhere safe, then select OK, I saved my recovery code.
The help page only mentions the QR code. It doesn't say whether Shortcut also shows a text key you could type in. If it does, in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key?
Your recovery code is your backup
Shortcut gives you one recovery code, not a set of them. Its help page doesn't say whether you can make a new one later, or whether the code still works after you've used it once. Treat it as precious.
That matters more if you haven't made a Novaz backup, because then its keys exist only on your iPhone. If the phone is gone and there's no Novaz backup to restore, the recovery code is the only way back in without involving your organization. Keep it in a password manager or on paper, away from your phone. More in 2FA backup codes.
Signing in with a code
With 2FA on, you enter your username or email and your password, select Log In, type the code from your authenticator app, and select Log In again (Shortcut). The help page doesn't mention a way to mark a device as trusted, so expect the code step whenever Shortcut asks you to sign in.
If Shortcut rejects your code
Shortcut's help center has no advice on rejected codes. The usual cause is the iPhone's clock. Open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
Shortcut's own example of when you'd need the recovery code is signing in from a new device without your authenticator app:
- On the sign-in screen or the 2FA screen, select Need to use your recovery code?
- Type your recovery code.
If you've misplaced the recovery code too, ask someone with Owner or Admin permissions in your Shortcut organization to contact Shortcut Support and have your 2FA turned off (Shortcut). Shortcut doesn't say what else Support checks or how long it takes. If you are the only Owner, the help page doesn't cover what happens. More in Lost the phone with your authenticator app?
Changing phones or turning 2FA off
Shortcut doesn't describe moving 2FA to a new phone. If you use Novaz's iCloud backup or a backup file, restore it on the new iPhone and Shortcut's codes come with it. Without one, while you still have the old phone, the safe route is to turn 2FA off and set it up again on the new one. See How to transfer your authenticator app to a new iPhone.
To turn it off, go back to Settings > Security > Two-Factor Auth, type your Shortcut password and a code from your authenticator app, and select Disable 2FA (Shortcut). Then, in Novaz, open the Shortcut account and tap Remove account.
