Withings 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Withings account holds what your scale, watch, blood pressure monitor or sleep tracker measures, and you reach it through the Withings App and the online dashboard. Withings calls its two-factor protection multi-factor authentication (MFA). It's optional, and you can pick an authenticator app, which Withings marks as recommended, or a code sent by WhatsApp, text message or phone call (Withings).
Two things set Withings apart. Signing in with your email address already uses a temporary code sent to your inbox, so with MFA on you type two codes: the email one first, then the one from your app (Withings). And MFA only works in the main Withings App: the separate Thermo, WithBaby, Withings Home and WiScale apps can't sign in to an account that has it on, so Withings says you'd have to turn MFA off to use them.
This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Withings steps come from Withings' own help center, linked below, which we read on October 21, 2026. The article pages block automated access, so we read them through the help center's public article feed on support.withings.com. We haven't tested the steps on a Withings account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on MFA with an authenticator app
On an existing account, the setting is in the Withings App (Withings):
- Open the Withings App and select Profile.
- Select the Settings gear in the upper-right corner, then Account & Security.
- Select Multi-factor authentication.
- Under Time-Based, select One-Time Password (TOTP).
- Withings gives you a setup key and can also show a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. Because the code is usually on the same iPhone as the Withings App, the simpler route is often a screenshot: tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- To type the key instead, tap +, then Enter key manually in Novaz, and paste it as the Setup key. See What is a 2FA setup key?
- Select Next and enter the code Novaz shows.
- Write down the recovery code Withings displays, then select I copied the code and Done.
Withings' help describes the setup key, the QR code and the last three steps in its section for new accounts, where MFA is offered right after you fill in your details. For existing accounts, the page stops after you choose TOTP, so the screens you see may differ a little. Withings' FAQ says the codes change about every 30 seconds (Withings), which is also what Novaz uses for a typed key. If the code doesn't match, scan the QR code instead.
The Android article lists the same steps (Withings).
Your one recovery code
Withings gives you a single recovery code, not a list. Its advice is to keep it somewhere other than your phone, since you'd need it exactly when the phone is gone (Withings). Keep it even if you back up Novaz: it's your way in if the phone is gone and you have no Novaz backup, or only one made before you added Withings.
You can see the code again later, either on the web dashboard or in the app under Multi-factor authentication > Recovery code. Withings first sends a temporary code to your email, then asks for a code from your authenticator app (or Use Another Method). Its MFA FAQ puts the same option under Account Recovery, so the label may differ. More in 2FA backup codes.
Extra checks for sensitive actions
Since version 8.4 of the Withings App, some actions trigger a fresh security check, including managing MFA, requesting recovery codes, changing your email address, deleting the account and moving profiles to a new phone. After one check, Withings won't ask again for ten minutes (Withings).
If Withings rejects your code
Make sure you're on the right screen: the first prompt wants the code from your email, the second wants the one from Novaz. Withings' help doesn't cover rejected app codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?
Changing phones
Withings lets you update your MFA method in account settings, but only while you're signed in with MFA (Withings). So switch the authenticator over before you give up the old iPhone. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead; without one, you'll set Withings up again on the new one. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with your recovery code, typed where the second code would go. Withings then asks you to set up MFA again. Because every sign-in starts with an email code, you also need access to your inbox: Withings says MFA won't work without it (Withings).
Without the recovery code, Withings' only advice is to contact its support team through the Contact us button at the bottom of its help pages. It doesn't say what proof it asks for or how long it takes. See Lost the phone with your authenticator app?
Turning MFA off
You can remove MFA under Profile > Settings > Multi-factor authentication, but only while signed in with MFA (Withings). That's also what you'd have to do to keep using Thermo, WithBaby, Withings Home or WiScale.
