Skip to content
Novaz AuthenticatorGET

VALR 2FA: how to switch from SMS to an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Switch to an authenticator app
  2. Your recovery code is the key itself
  3. When VALR asks for a code
  4. If VALR says "Incorrect Code"
  5. New phone, lost phone, or removing 2FA
  6. Official VALR help

VALR is a South African crypto exchange, and every account already has a form of two-factor authentication (2FA): VALR turns on SMS codes by default and recommends moving to an authenticator app (VALR). The switch is more than a security upgrade here. Several features only open up once an app is in charge of your codes:

  • Higher withdrawal limit. A fully verified account can withdraw crypto worth 0.2 BTC a day. With app-based 2FA on, you become Fully-verified PLUS and the limit goes to 100 BTC a day (VALR).
  • API keys. VALR won't create API keys until app-based 2FA is on (VALR).
  • Shared account access. You need 2FA on your account to invite guests or accept an invitation (VALR).

This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the VALR steps come from VALR's own help center articles, linked below, which we read on October 22, 2026. The help center's web pages refused our plain requests, so we read the same articles through the help center's public article feed on support.valr.com. We haven't tested the steps on a VALR account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Switch to an authenticator app

VALR describes the same flow on its website and in its mobile app; only the first steps differ (VALR).

  1. Sign in to VALR.
    • On the website: click Profile in the top right corner, choose Security, then under Two-Factor Authentication click Use an App.
    • In the VALR app: tap your profile name in the top right corner, then Security. Open Two-Factor Authentication and switch the toggle from SMS to APP.
  2. Type the one-time code VALR texts to your phone number. Your current SMS 2FA has to approve the change.
  3. VALR shows a QR code and a secret key on the security page. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If you're doing this in the VALR app on the same iPhone, take a screenshot and tap +, then Choose a photo instead. See scanning a QR code on the same iPhone.
  4. If you'd rather type the secret key, tap +, then Enter key manually in Novaz. Put VALR under Service, your email under Account if you like, and the key under Setup key. See What is a 2FA setup key?
  5. Enter the code Novaz shows for VALR.
  6. Write down the 2FA recovery code VALR gives you and keep it away from your phone.
  7. Click Activate.

VALR's help doesn't state how many digits its own codes have. Its general 2FA article speaks of authenticator apps making 6-8 digit codes every 30 seconds. Scanning the QR code is the safer route, because the code carries the settings with it. A key typed by hand in Novaz always gives 6-digit codes every 30 seconds.

Your recovery code is the key itself

VALR's recovery code works differently from the one-time backup codes many sites hand out. According to its help, you restore 2FA by typing the recovery code into an authenticator app as a new account's key, and the app then makes valid VALR codes again (VALR). So the recovery code is as sensitive as your password and your phone together. Anyone holding it can produce your codes.

Unless you've backed up Novaz with iCloud backup or a backup file, its keys exist only on your iPhone, and this code is then your only way back without VALR Support. In Novaz you'd add it with Enter key manually, in the Setup key field. VALR doesn't describe the code's format. Novaz accepts a base32 key of at least 16 characters, so if your saved code is shorter or won't go in, contact VALR Support instead. More in 2FA backup codes.

When VALR asks for a code

Beyond signing in, VALR asks for your 2FA code to approve a new address in your wallet address book and to approve every withdrawal, even to an address you've already saved (VALR). Creating an API key also ends with a 2FA code, entered after you click the authorization link VALR emails you (VALR). VALR also says it asks you to authorize sign-ins from any new device or location (VALR).

If VALR says "Incorrect Code"

VALR puts most of these errors down to the time on your phone being out of sync (VALR). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. If it's already on, VALR suggests turning it off, waiting a few seconds and turning it back on. Novaz also warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

New phone, lost phone, or removing 2FA

VALR documents two routes (VALR):

  1. You have your recovery code. Add it to the authenticator app on your new phone as the key, as above, and sign in.
  2. You don't. Submit a ticket through VALR's support request form. The same form is VALR's route if you want 2FA reset or removed (VALR). VALR's help doesn't list the proof Support asks for or how long a reset takes.

On a new phone, restore Novaz from iCloud backup or a backup file if you have one; otherwise add VALR again with the recovery code or a fresh setup. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?

Plan for a pause in withdrawals afterwards. VALR blocks fiat and crypto withdrawals, linking a bank account and creating API keys with withdrawal rights for a while after a security change: 24 hours when you reset 2FA yourself, and 3 days when VALR Support removes it. It also emails, texts and sends an app notification about the change, with a link to block your account if you didn't make it (VALR).

Official VALR help

More guides: Crypto exchanges and wallets