Twingate 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Twingate is the client many companies use in place of a VPN to reach private servers and internal apps, which Twingate calls Resources. You sign in through your company's identity provider or a Google, Microsoft, LinkedIn or GitHub login (Twingate). Twingate also has its own two-factor authentication, called native MFA. It's separate from any code your identity provider asks for, and it isn't something you switch on yourself: an admin requires it in a policy (Twingate).
The methods are an authenticator app (TOTP), biometrics such as Touch ID, and FIDO2 security keys. Everyone needs the authenticator app, because Twingate asks for it as the backup even if you pick another method. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Twingate steps come from Twingate's own documentation and knowledge base, linked below, which we read on October 20, 2026. We haven't tested them on a Twingate account. The setup pages don't name every button, so what you see may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Where an admin turns it on
MFA is a setting on a policy, in one of three places (Twingate):
- the Sign In Policy tab on the Policies page, for signing in to the Twingate Client (Twingate);
- a Resource Policy, for the Resources it protects (Twingate);
- Settings > Admin Console Security, for admins opening the Admin Console (Twingate).
Twingate suggests picking one place, and skipping it entirely if your identity provider already asks for a second factor, so people aren't asked twice (Twingate).
Set up the authenticator app
Once a policy requires it, Twingate walks you through setup the first time it applies to you (Twingate):
- Sign in, or open a Resource that needs it (these show a lock icon in the Client). Click the notification Twingate sends, or choose Authenticate from the Resource's menu. A browser window opens (Twingate).
- Twingate shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
- On your iPhone itself, Twingate says its alphanumerical ID may be easier. That ID is the setup key: in Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key? Or screenshot the QR code and use Choose a photo (how).
- Type the code Novaz shows to confirm it works.
- Twingate then offers biometrics or a security key as extra methods, registered through your browser.
Twingate only says it uses the standard TOTP format. If a code from a typed key is refused, scan the QR code instead, so Novaz gets the exact settings.
When Twingate asks for a code
With MFA on the Sign In Policy, you need a code each time you sign in to the Client, at an interval of 7 to 31 days (Twingate). On a Resource Policy, you need one when its timer runs out, after 1 hour to 31 days. One successful check resets the timer for all your Resources (Twingate).
On a Mac the prompt is a notification, so it won't show if Twingate's notifications are off or Do Not Disturb is on (Twingate).
No backup codes
Twingate's pages don't mention backup or recovery codes. They do warn: "Do not delete the authentication app or the Twingate code inside the app" (Twingate). Novaz keeps its keys on your iPhone, and only there unless you turn on iCloud backup or export a backup file, so add biometrics or a security key when Twingate offers. Either one also meets the requirement.
If Twingate rejects your code
Twingate's docs don't cover rejected codes. If your company also has MFA at its identity provider, make sure you're typing the Twingate entry's code. Then check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More causes are in Authenticator code not working?
Lost or new phone: ask an admin
Twingate's docs describe no way to reset it yourself. An admin with the Admin or Helpdesk role resets your MFA from your user page in the Admin Console, and you set it up again the next time Twingate asks (Twingate). Twingate doesn't say what proof to ask for, so that's up to your company. The admin goes to Team > Users, clicks your name, hovers over the method until the reset icon appears, and confirms with Reset (Twingate).
If you made a Novaz backup (iCloud backup or a backup file), restore it on the new iPhone and your Twingate codes keep working. Without one, a new iPhone needs the same reset. Keep the old phone until it's done. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
If you're your network's only admin, the docs don't describe a way back in, and Twingate's technical support covers only Business and Enterprise plans (Twingate). A second admin or Helpdesk user could reset it for you.
Turning it off
Not on your own. It stays on while a policy that applies to you requires MFA, and only an admin can change that policy.
