Skip to content
Novaz AuthenticatorGET

TP-Link 2FA: how to set up an authenticator app for your TP-Link ID

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Add email as a backup
  3. Where TP-Link asks for the code
  4. When an Omada controller requires 2FA
  5. If TP-Link rejects your code
  6. If you lose your authenticator
  7. Changing phones or turning 2FA off
  8. Official TP-Link help

Your TP-Link ID signs you in to TP-Link's apps and cloud services, from Tapo cameras and Deco mesh Wi-Fi to Omada business networks and VIGI security cameras. It has two kinds of extra sign-in check, and only one works with an authenticator app:

  • Two-factor authentication (2FA) on the TP-Link ID, documented for Omada and VIGI. It uses time-based codes from an authenticator app, with email as an optional second method (TP-Link).
  • Two-Step Verification in the home apps (Tapo, Kasa, Deco). It sends a code to a device you already trust, or by email. These apps' help pages don't mention authenticator apps (TP-Link, TP-Link, TP-Link).

This guide covers the first. TP-Link's help doesn't call it mandatory, but an Omada administrator can require it for a controller. We use Authenticator App - Novaz on iPhone in the steps. Any authenticator app works the same way.

How we checked this guide: the TP-Link steps come from TP-Link's own help pages, on tp-link.com and its Omada support site, linked below, which we read on October 20, 2026. We haven't tested them on a TP-Link account, and labels vary between TP-Link's product articles, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

TP-Link's VIGI article, updated September 14, 2026, has the most detailed steps (TP-Link):

  1. Sign in to VIGI Cloud VMS (vms.tplinkcloud.com) with your TP-Link ID and password.
  2. Click the profile icon in the upper-right corner, then Account Settings.
  3. Click Security and turn on Two-Factor Authentication (2FA). Click Confirm to close the prompt.
  4. Enter your TP-Link ID password and click Confirm.
  5. A QR code appears. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
  6. Type the 6-digit code from Novaz and click Submit.

From Omada, the switch is under Account Settings in Omada Cloud (omada.tplinkcloud.com), or under your profile picture > Security in the Omada app (TP-Link). An older Omada article puts it under Settings > Security (TP-Link).

The pages show only a QR code and don't mention a typed key or how often codes change, so scan it: the QR code carries those settings to Novaz.

Add email as a backup

Omada's June 2026 article strongly recommends adding a second method, such as email. Without one, a lost authenticator means contacting support (TP-Link). TP-Link mentions no backup codes, so email is your fallback, especially if you haven't backed up Novaz with iCloud backup or a backup file.

Omada's article says "any login attempt using that ID will require 2FA authentication" (TP-Link). Every place TP-Link lists is in Omada or VIGI: their cloud portals, apps, controllers and VIGI VMS software (TP-Link, TP-Link). Turning 2FA on in VIGI also turns it on for Omada.

TP-Link doesn't say whether Tapo, Kasa or Deco ask for the authenticator code. Their help covers only their own Two-Step Verification, under Login Security in each app.

When an Omada controller requires 2FA

An administrator can turn on 2FA under Global View > Settings > Account Security. Then every account needs it to sign in to that controller (TP-Link). A local controller account is guided through setup at the next sign-in: it's asked for an email address (skippable, but it's the recovery route), then shown a QR code to scan. TP-Link ID users are turned away until they turn on 2FA for the ID.

TP-Link says the codes are time-based, so your phone's clock must be accurate and set automatically (TP-Link). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

If you lose your authenticator

TP-Link's pages disagree:

  • The June 2026 Omada article says you can no longer turn 2FA off while signing in. You recover by email instead, if you added an email method. Without one, contact support through support.omadanetworks.com (TP-Link).
  • The older Omada article and the VIGI article describe a link on the code screen that emails you a way to turn 2FA off (TP-Link, TP-Link).

TP-Link can't recover a local Omada controller account with no email, since it's stored on the controller. An account with higher privileges can recreate it; otherwise the controller has to be reinstalled, losing its configuration. TP-Link doesn't say what proof support asks for or how long recovery takes. See Lost the phone with your authenticator app?

Changing phones or turning 2FA off

To turn it off, go to id.tplinkcloud.com and switch off Security > Two-Factor Authentication (2FA), using a current code (TP-Link). VIGI Cloud VMS has the same switch under Account Settings > Security (TP-Link).

TP-Link doesn't describe moving to a new phone. With the documented steps, that means turning 2FA off while you still have the old phone, then on again with the new one. If you have a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.

More guides: Smart home and devices