Wasabi 2FA: how to set up an authenticator app for the Wasabi Console

Your Wasabi account signs you in to the Wasabi Console, where you manage storage buckets, users and billing. Wasabi calls two-factor authentication "multi-factor authentication" (MFA), and its documentation describes it as a virtual MFA device: an authenticator app on your phone that makes time-based codes (Wasabi).

For some accounts it isn't optional. New trial accounts must set up MFA, a rule Wasabi added in summer 2026 (Wasabi, Wasabi). A Root user can also make it mandatory for every sub-user. Wasabi lists the apps it has tested, and says you're welcome to try others. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Wasabi steps come from Wasabi's own documentation site, docs.wasabi.com, linked below, which we read on October 21, 2026. We haven't tested them on a Wasabi account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on MFA with an authenticator app

The unusual part comes at the end: Wasabi wants two codes from your app, one after the other. Each code expires quickly, so read the steps first. Wasabi's MFA page, updated in September 2026, describes this flow (Wasabi):

1. Sign in to the Wasabi Console and click Security in the Wasabi menu, then MFA.
2. Wasabi shows a QR code. The secret key is hidden: click the icon next to it to show it, if you'd rather type the key.
3. Turn on the Recovery Codes toggle. Wasabi recommends it.
4. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. To type the key instead, tap +, then Enter key manually, and paste it into Setup key. Wasabi doesn't say how long its key is, so if Novaz won't accept it, scan the QR code. See What is a 2FA setup key?
6. Type the code Novaz shows into Authentication Code 1 straight away.
7. Wait for Novaz to show the next code, about 30 seconds later, and type it into Authentication Code 2.
8. If you left recovery codes off, click Activate Virtual MFA. If you turned them on, Wasabi shows your recovery codes. Copy, download or print them, then click Finish.

Older pages put the setting under Settings > Security Settings > MFA Settings, and the sign-up guide names the last button Activate MFA, so your screens may differ a little (Wasabi, Wasabi).

Root users and sub-users

Wasabi allows one virtual MFA device per account or user. A Root user can set up MFA for a sub-user from Users, by clicking the sub-user's name and then MFA Settings. A sub-user can only do it alone with full Console access or with a policy the Root user creates, and that policy doesn't let sub-users turn MFA off (Wasabi).

To require MFA for all sub-users, the Root user goes to Security > User Security Options, turns on the toggle and clicks Turn On (Wasabi).

Recovery codes and the secret key

Wasabi shows the recovery codes once. After you click Finish or close the window, the Console won't show them again. If you skipped them, Wasabi's way to get some is to reset MFA and turn it back on with the toggle on. If your phone is lost without a Novaz backup to restore, these codes get you in: keep them in a password manager or on paper. See 2FA backup codes.

Wasabi also suggests saving a copy of the secret key somewhere secure. With it, you can set up the same virtual MFA again after losing your phone or reinstalling the app. Guard it like a password.

When Wasabi asks for a code

Once MFA is on, the Sign In page has an MFA Code field. Wasabi also asks for a code to change Advanced Options, to manage security contacts for Multi-User Authorization, and to turn MFA off (Wasabi, Wasabi).

If Wasabi rejects your code

Wasabi's advice is to enter each code as soon as it appears, because it expires quickly. During setup, wait for a fresh code for the second box rather than typing the same one twice. If codes still fail, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

If you have a Novaz iCloud backup or backup file, restore it on the new iPhone and your Wasabi codes keep working. Otherwise, if you saved Wasabi's secret key, add it to the new phone with Enter key manually. If you have neither, turn MFA off on the old phone and set it up again on the new one. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

On the Sign In panel, click Recovery Options and enter one of your recovery codes. A saved secret key also lets you rebuild the account in Novaz. Sub-users should ask the Root user, who manages their MFA settings.

Without codes or a key, Wasabi's documentation doesn't describe a recovery route, what proof it wants, or how long it takes. Its general contact is Wasabi Support at support@wasabi.com. See Lost the phone with your authenticator app?

Turning MFA off

Open the MFA settings, click Deactivate MFA Device, enter a code from your app or a recovery code, and click Deactivate (Wasabi). Then open Wasabi in Novaz and tap Remove account.

Official Wasabi help

• MFA (Multi-Factor Authentication)
• 1—Signing Up for Wasabi
• What's New for Console?
• User Security Options
• Defining a Policy for Sub-Users to Change Passwords and Enable MFA
• Setting Advanced Security Options
• MUA (Multi-User Authorization)
• What are Wasabi's recommended general user security best practices?