X (Twitter) 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your X account, the one that used to be Twitter, offers three kinds of two-factor authentication (2FA): Text message, Authentication app and Security key. Text messages aren't open to everyone. Since March 20, 2023, X has offered them only to X Premium subscribers, and even then it depends on your country and carrier (X, X). For most accounts, the choice is an authenticator app or a physical security key.
2FA is optional, though X recommends it (X). X accepts any time-based (TOTP) authenticator app. This guide uses Authenticator App - Novaz on iPhone, but any of them works the same way.
How we checked this guide: the X steps come from X's own Help Center and company blog, linked below. X's help site blocks automated readers, so on October 19, 2026 we read archived copies on web.archive.org, saved between July and October 2026. We haven't tested the steps on an X account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
These steps are for x.com on a computer, so you can scan the QR code with your iPhone (X):
- In the side menu, click More, then Settings and privacy.
- Click Security and account access, then Security, then Two-factor authentication.
- Check the box next to Authentication app. Read the overview and click Start.
- If X asks for your password, enter it and click Verify.
- If your account has no confirmed email address yet, X asks for one now. Enter it and click Next, then type the code X emails you and click Verify.
- X shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. Then click Next.
- Type the code from Novaz and click Verify, then click Got it.
In the X app for iPhone, the path starts from the main menu with the same labels, and X's help calls the QR step Link app now. If the QR code shows up on the same iPhone as Novaz, take a screenshot, tap + in Novaz, then Choose a photo. See scanning a QR code on the same iPhone.
X's help doesn't mention a key you can type instead, or the code length, so scan the QR code.
Keep a backup code
X's backup codes follow their own rules (X):
- X makes one automatically when you turn on 2FA in its iPhone or Android app, and you can generate one on x.com. X's authenticator steps don't mention it, so check that you have one.
- X's troubleshooting page lists Backup code under Settings and privacy > Account > Security. Those menu names differ from the ones above, so yours may look different.
- You can have up to five active codes. Use them in the order you made them: using one out of order cancels every code generated before it.
- They work on x.com, mobile.x.com and X's own apps, not in third-party apps.
If that phone is lost and you have no Novaz backup (iCloud backup or a backup file), the backup code is your way back in. Keep it on paper or in a password manager. See 2FA backup codes.
Signing in afterwards
Each time you sign in, X asks for your password and the 2FA method you used last time. Choose a different two-factor authentication method lets you switch. X's help doesn't mention skipping the code on trusted devices (X).
Some other devices and apps that ask for your X password won't take your usual one once 2FA is on. They need a temporary password from Two-factor authentication > Additional methods > Temporary password, valid for one hour. The X apps and mobile.x.com don't need one (X).
If X rejects your code
X's help doesn't cover rejected authenticator codes. For backup codes, it says an inactive one, or one used out of order, gives an error, and you need a new one (X).
For codes from Novaz, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
X's help suggests turning off 2FA while you're still signed in (X). Before you give up the old iPhone, turn off Authentication app on x.com, then turn it on again and scan the new QR code with Novaz on the new iPhone. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead and skip this. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
X describes these routes (X):
- You have a backup code. Sign in with your username and password. When X says a 2FA request was sent, follow the link to enter a backup code, then update your settings.
- You're still signed in somewhere, such as x.com on a computer. Turn off 2FA under Two-factor authentication there, then set it up again.
- Neither. X says to contact its support team. On Contact us, choose Problems with account access. X's pages don't say what proof it asks for or how long it takes.
More in Lost the phone with your authenticator app?
Turning 2FA off
On x.com, open Two-factor authentication as in the setup steps and uncheck the box next to your method. In the iPhone app, tap the switch next to the method, then tap Turn off twice (X). Then open X in Novaz and tap Remove account.
