Veracode 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
The Veracode Platform is where development and security teams run code scans and review the findings. Your account there is created by an administrator in your organization, and so is the decision about multifactor authentication (MFA): Veracode's documentation describes it as a setting an administrator turns on for your user account, which you then set up the next time you sign in (Veracode, Veracode). Veracode supports time-based codes from an authenticator app, hardware security keys, biometric sign-in such as Touch ID or Windows Hello, and Okta Verify (Veracode). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Veracode steps come from Veracode's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a Veracode account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Who turns it on
An administrator or team administrator sets Requires MFA to Yes when creating or editing your user, on the Users tab of the Administration page. The default is No (Veracode). Veracode's documentation doesn't describe a way for you to switch MFA on yourself, so if you want it and don't get asked to set it up, ask your Veracode administrator.
If your organization signs you in with single sign-on (SSO), you start at your company's identity provider, such as Okta, Ping Identity or Microsoft Entra ID, rather than with a Veracode password (Veracode). In that case your company's own sign-in rules apply, and the steps below may not.
Set up the authenticator app
Once MFA is required on your account, Veracode asks you to choose a method the first time you sign in (Veracode):
- Go to the Veracode Platform for your region: analysiscenter.veracode.com for most organizations, analysiscenter.veracode.eu for the European Region, or analysiscenter.veracode.us for the United States Federal Region (Veracode).
- Enter your username, which is usually your email address, and your password, then select Sign in.
- Under Google Authenticator, select Setup. The name is misleading: Veracode says this option works with any app that makes standard time-based codes.
- Select your mobile device type and follow the instructions on the screen.
- When Veracode shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Enter the 6-digit code from Novaz to finish.
Veracode's documentation doesn't show these screens, so it doesn't say whether a text key is offered as an alternative to the QR code, or what it's called. If you do get one, tap + in Novaz, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key? Veracode says the app makes a six-digit code (Veracode), which matches what Novaz produces by default.
When Veracode asks for a code
Every time. Veracode says you need a code from your chosen method each time you sign in to the Veracode Platform (Veracode). After your password, you enter the code and select Verify (Veracode).
There's one practical advantage of an authenticator app here. Veracode's IDE plugins and the Veracode CLI use a different sign-in address from the web platform. Security keys and biometric sign-in work with only one of those two addresses, but an authenticator app works with both (Veracode).
No backup codes in the documentation
Veracode's documentation doesn't mention backup or recovery codes, and doesn't describe adding a second method as a fallback. Unless you've made a Novaz backup (iCloud backup or a backup file), that iPhone is your only way to get a code. Treat it accordingly, and know who your Veracode administrator is before you need them.
If Veracode rejects your code
Veracode's documentation doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Make sure you're also using the newest code, not one that's about to change. More in Authenticator code not working?
New phone, lost phone, or a different method
All of these go through the same route. To set up your MFA method again, Veracode says to contact Veracode Technical Support at support@veracode.com (Veracode). Its documentation doesn't say what proof Support asks for or how long a reset takes. Talking to your organization's Veracode administrator first may help, since they manage your account.
If you're changing phones, keep the old one working until the reset is done, then set up Novaz on the new phone when Veracode next asks you to choose a method. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead of asking for a reset. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
Veracode's documentation doesn't describe turning MFA off for your own account. Since the Requires MFA setting belongs to your administrator, that's the person to ask.
