Workato 2FA: how to set up an authenticator app

Workato is an automation platform where teams build recipes and AI agents in shared workspaces. Two-factor authentication (2FA) is set on your personal profile, but a workspace can make it a condition of entry. If a workspace you belong to turns it on, you have to set it up on your own profile to keep your access, and new collaborators have to do it before they can join (Workato). The only second step Workato documents is a code from an authenticator app on your phone (Workato). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Workato steps come from Workato's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on a Workato account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Who sees the 2FA prompt

Since September 1, 2024, people who sign in to Workato with an email address and password see an extra screen after signing in that invites them to set up 2FA before they reach their workspace (Workato). You can also start it later from your profile.

If you joined through single sign-on (SSO) and have never had a Workato password, there's an extra step first. Workato asks for your password before it changes any 2FA setting, so use the Forgot password link on the sign-in page to create one by email (Workato).

Turn on 2FA with an authenticator app

Workato's documentation lists these steps (Workato):

1. Sign in to Workato. If you see the 2FA screen, click Set up two-factor authentication. If you skipped it, open My profile, go to Two-factor authentication and start the setup there. (The same page also calls the menu Profile settings and the button Setup two-factor authentication, so the wording may vary.)
2. If Workato asks, enter your password and click Verify password. Workato won't ask again for 15 minutes.
3. Workato shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. Workato also offers a code to register by hand, though its page doesn't give that option a label. In Novaz, tap +, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key? Workato doesn't say how often its codes change, so scanning is safer.
5. Click Next, then enter the six-digit code that Novaz shows for Workato.
6. Click Copy or Download to save your recovery codes. A download arrives as a file named workato_2fa_recovery_codes.

Your 12 recovery codes

Setup gives you twelve recovery codes. Each one works a single time in place of the six-digit code. Workato suggests keeping them away from your authenticator app, ideally on a device other than your phone (Workato). That matters with Novaz too: without an iCloud backup or backup file, its keys live only on your iPhone, so the recovery codes are your way in if that phone is gone.

Workato lets you see the codes again later. Under My profile > Two-factor authentication, click View recovery codes. If you think someone else has seen them, or you've used most of them, click Regenerate codes on the same screen for a fresh set. The FAQ calls that button Regenerate recovery codes (Workato). More in 2FA backup codes.

When Workato asks for a code

You'll be asked for a code when you sign in with email and password to a workspace that requires 2FA, and when you switch into such a workspace from one that doesn't. After some security changes, Workato signs out every session, so you sign in again with a code (Workato).

To skip the code on a computer you trust, choose Trust this device when asked. The main 2FA page, updated September 2026, says this lasts 7 days. The older FAQ says 30 days, so check what your screen shows. Trusted devices are listed on your 2FA settings page, where you can revoke any you no longer use.

If Workato rejects your code

Workato's pages don't cover rejected codes. Check that your iPhone sets its own time: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. For other causes, see Authenticator code not working?

Changing phones or losing your phone

Workato handles a new phone and a lost phone the same way: sign in, using a recovery code if the old phone is gone, then turn 2FA off and set it up again with the new device (Workato). Doing this also cuts off the lost phone. If you're upgrading and have a Novaz iCloud backup or backup file, you can restore it on the new iPhone instead. Otherwise, do the reset while the old phone still works. See How to transfer your authenticator app to a new iPhone.

If you have neither the phone nor a recovery code, Workato's 2FA pages don't describe a recovery route or say who can reset it. More in Lost the phone with your authenticator app?

Turning 2FA off

Open Profile settings, then Two-factor authentication > Disable two-factor authentication. Verify your password if asked, then click Disable 2FA (Workato). This also removes all your trusted devices. Workato says collaborators need 2FA on their profile to keep access to a workspace that requires it, so expect to lose that access until you set it up again. Afterward, open Workato in Novaz and tap Remove account.

Official Workato help

• Two-factor authentication
• Two-factor authentication FAQs
• Security