Wave 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Wave is accounting, invoicing and payroll software for small businesses and freelancers. Two-factor authentication (2FA) is optional for most Wave users, but not for everyone: if you use Wave's payroll or online payments, Wave requires it (Wave). You can get the sign-in code by text message or from an authenticator app, and Wave lets you keep only one of those active at a time. This guide uses Authenticator App - Novaz on iPhone. Novaz works like any other authenticator app here.
How we checked this guide: the Wave steps come from Wave's own help center, linked below, which we read on October 21, 2026, through the help center's public article feed. We haven't tested them on a Wave account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Who has to turn it on
- Payroll and online payments users: 2FA is required. If you turn it off, Wave signs you out and asks you to set it up again (Wave).
- Collaborators on someone else's business: optional, unless they have payroll management access (Wave).
- Everyone else: optional, and you can turn it off whenever you like.
Turn on 2FA with an authenticator app
Wave describes these steps for the web version (Wave):
- Sign in to Wave in a web browser. At the top right, click your business name, then Profile Settings.
- In the Profile menu, click Password & Security.
- Click Set up authenticator app. If text-message codes are already active, click Turn off next to that method and confirm with Turn off… first, because only one method can be on.
- Wave shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If you're on the iPhone itself, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Click Continue, type the six-digit code from Novaz, and click Continue again.
- Wave shows your recovery keys. Click Download (.txt file) to save them, then click Done.
Wave sends you a confirmation email, and the authenticator method shows an Active label.
From the Wave mobile app (Canada only)
Wave's help says you can start the setup in the mobile app only if your account location is Canada. Tap More, then the General tab, then Two-factor authentication. This opens Wave in your phone's browser. Tap Authenticator app. Here Wave offers Manually enter setup key as well as the QR code (Wave). If you set it up on the same iPhone, copy that key, then in Novaz tap +, then Enter key manually, and paste it as the Setup key. See What is a 2FA setup key? The web steps don't mention a text key.
Save your recovery keys
A recovery key lets you sign in when you can't get a code, and each key works once. Wave's newer article says it makes eight of them (Wave). If your phone is gone and you have no Novaz backup (iCloud backup or a backup file) to restore, these recovery keys are how you get in. Keep the file off that phone, for example in a password manager.
If you use them up or lose them, go back to Password & Security and click Generate new recovery keys, then Download (.txt file). Your old keys stop working. Wave also makes a fresh set each time you turn 2FA on again (Wave). More in 2FA backup codes.
When Wave asks for a code
With 2FA on, Wave asks for a code each time you sign in (Wave). Its sign-in steps include the code on the web and in the mobile app, also after Sign in with Google or Sign in with Apple (Wave). Wave's help doesn't mention a way to trust a device.
If Wave rejects your code
Wave's help sends you to the authenticator app maker's own troubleshooting pages, which don't cover Novaz. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Wave doesn't describe moving its authenticator to a new phone. Its documented way to change methods is to turn the active one off and set one up again, so do that on Password & Security while you can still sign in. If payroll or online payments make 2FA required, Wave will sign you out and ask you to set it up straight away. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and keep the same codes. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with one of your recovery keys, then set up 2FA again on your new phone. Without a recovery key, Wave's help points you to its support team through its support request form. It doesn't say what proof of identity support asks for or how long a reset takes. Wave's support page also says the team answers Monday to Friday, 9 AM to 5 PM Eastern, and that direct help from the team depends on what you use, such as payroll or the Pro Plan (Wave). More in Lost the phone with your authenticator app?
Turning 2FA off
Unless 2FA is required for you, go to Password & Security, click Turn off next to your active method, then Turn off… in the pop-up. The method then shows Inactive (Wave). In Novaz, open the Wave account and tap Remove account.
