Todoist 2FA: how to set up an authenticator app

Todoist's two-factor authentication (2FA) is optional and has one method: a 6-digit code from an authenticator app. Its help describes no text-message option and says "Physical security keys for 2FA aren't supported yet" (Todoist). This guide uses Authenticator App - Novaz on iPhone. Any other authenticator app follows the same steps.

How we checked this guide: the Todoist steps come from Todoist's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a Todoist account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

If the switch won't turn on, Todoist's first suggestion is to verify your account (Todoist). Email sign-ups get a message with a Verify email button; Google and Apple sign-ups don't need it (Todoist).

Use a computer if you can: the web steps let you scan the secret code, while the phone steps only mention copying it (Todoist).

1. Log in to Todoist in a browser. Click your avatar in the top-left, then Settings.
2. Choose Account in the left-hand menu.
3. Click the toggle below Two-factor authentication. Todoist shows the secret code.
4. In Novaz, tap +, then Scan QR code, and point the camera at the screen.
5. Type the 6-digit code from Novaz as the verification code. After the confirmation notice, click Continue.
6. Under Save your recovery codes, click Copy all codes and paste them somewhere that isn't your phone. Click Continue.

In the iPhone app, the path is Browse at the bottom right, the gear icon, Account, then the Require 2FA toggle. The Android steps call it Two-factor authentication, so labels vary by app. Copy the secret code, and in Novaz tap +, then Enter key manually, and paste it as the Setup key (What is a 2FA setup key?). Enter the code from Novaz in Todoist, tap Done, copy your recovery codes, and tap Done again.

Todoist doesn't say how often its codes change or how long the key is. A typed key in Novaz gives 6-digit, 30-second codes and needs at least 16 characters. If either side refuses, set 2FA up in a browser and scan instead. For a browser on the same iPhone, see scanning a QR code on the same iPhone.

When Todoist asks for a code

Not only at sign-in. Todoist also wants a code before you turn 2FA off, change your account email, download a backup of your account, delete the account, or view your recovery codes (Todoist).

Google, Apple and Facebook sign-ins aren't exempt: Todoist says the 2FA requirement still applies to them (Todoist). You may still get a login alert when someone else tries your account; without the code they can't get in (Todoist). Change your password if that happens.

Your recovery codes are the backup

A Todoist recovery code is 8 letters and numbers. You get a set when you turn 2FA on (Todoist), and Todoist's support team can also issue one (Todoist). To use one, sign in at app.todoist.com and click Enter a recovery code here below the Authentication code field.

Hold on to these codes even if you back up Novaz: they get you in if the phone is lost without an iCloud backup or backup file, or if your backup is out of date. Keep them in a password manager or on paper. More in 2FA backup codes.

If Todoist rejects your code

Todoist's checklist: type the code as shown, before it expires, with your phone's clock in sync (Todoist). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz shows a warning when the clock drifts by 15 seconds or more. If codes still fail, Todoist's next step is a recovery code. See also Authenticator code not working?

If you lose your authenticator

1. Use a saved recovery code at sign-in.
2. Ask Todoist for one through its contact form, which offers Continue without logging in. The code goes to your account email address, so you need that mailbox (Todoist).
3. Start over. To turn 2FA off afterwards, Todoist says to ask for a second recovery code, with a new message or a reply in My Tickets. Then add a fresh entry in your app and turn 2FA back on.

Lost the email account too? Todoist accepts a screenshot of Account settings from a device that's still signed in, a Pro or Business receipt, or details of the last charge, such as the card's last four digits (never the full number or CVV). The password link it then sends doesn't turn 2FA off, so mention in your request if you can't give a code. With no proof at all, the account can't be restored (Todoist). Todoist doesn't say how long recovery takes. See Lost the phone with your authenticator app?

Moving to a new iPhone

Todoist doesn't document moving 2FA to another phone; the reset it describes is turning 2FA off and on again with a fresh entry (Todoist). Do that while the old iPhone still works, since turning 2FA off takes a code from it, and scan the new secret code with Novaz on the new phone. Afterwards, open the old entry in Novaz and tap Remove account. If you have a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes (How to transfer your authenticator app to a new iPhone).

Turning 2FA off

Go to Settings > Account, switch off Two-factor authentication, and enter a code from your app. Without the app, switch it off, click Click here to use a recovery code instead, and enter a recovery code (Todoist).

Official Todoist help

• Set up two-factor authentication for your Todoist account
• Troubleshoot two-factor authentication issues in Todoist
• Regain access to your Todoist account
• Set up your Todoist account