Xero 2FA: how to set up an authenticator app for your Xero login
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your Xero login covers Xero's accounting software, Xero Central and Xero's mobile apps (Xero). Xero calls 2FA multi-factor authentication (MFA), and anyone with access to a paying subscription has to set it up. People on a 30-day trial, or who only use Xero portal and Ask portal, don't need it (Xero).
You can approve sign-ins with push notifications from Xero's own app, Xero Verify, or type codes from any authenticator app. There are no backup codes, only a backup email address or security questions. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Xero steps come from Xero's own help center, Xero Central, and its MFA FAQ, linked below, which we read on October 19, 2026. Xero Central loads its articles with JavaScript, so we read the text from the data the site itself loads. We haven't tested the steps on a Xero account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Use a web browser, not the Xero Accounting app. Xero recommends an authenticator on a different device from the one you use for Xero. If MFA is required for you, Xero prompts you at login and you start at step 3 (Xero):
- Click your initials or profile image at the top right, then select Account.
- Next to Multi-factor authentication, click Set up.
- Click Set up multi-factor authentication and choose an authenticator app. Xero's help only names Xero Verify, its push app, so choose a different one.
- In Novaz, tap +, then Scan QR code, and scan the code Xero shows.
- Setting up on the same iPhone? Xero says to tap Enter key instead. In Novaz, tap +, then Enter key manually, and fill in Xero as the Service, your Xero email as the Account, and the key as the Setup key. Xero's troubleshooting page calls this Set up manually. Or screenshot the QR code and use Choose a photo (how).
- Follow the steps in Xero to finish, with the current code from Novaz ready.
- Add a backup email address (not your login email), click Continue, and enter the code Xero sends there. To use security questions instead, click Add backup security questions instead. Answers need five or more characters, letters and numbers only.
Xero's codes are 6 digits and change every 30 seconds (Xero), which matches what Novaz makes from a typed key. See What is a 2FA setup key?
Your backup method is Xero's only spare
Unless you've turned on iCloud backup or exported a backup file in Novaz, its keys exist only on that iPhone. Without that phone or a Novaz backup, your backup method is the way in (Xero). Xero's FAQ advises a strong, unique password on the backup email account (Xero).
To change the backup email, click Change next to Backup email address in Account. Changing to or between security questions means turning MFA off and on again (Xero).
Signing in
After your password, type the six-digit code from Novaz and click Verify. Tick Don't ask again for 30 days to skip the step on that computer and browser (Xero). Xero asks again on another browser or computer, after you clear cookies, in private browsing, or on a different internet connection. The option doesn't work with a backup method (Xero).
If Xero rejects your code
Xero says to check you typed the latest code correctly, without the space some apps show after the first three digits, and to let your phone set its time automatically (Xero). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
Five failed attempts, codes included, lock the account. Xero says to wait 15 minutes, then try again (Xero). More causes: Authenticator code not working?
Changing phones
MFA can only be set up on one device (Xero). Install Novaz on the new phone. In Xero, go to Account and, under Additional Security, click Change in the Connected device section. Confirm it's you, then add Xero to the new phone (Xero). If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead, and the codes keep working. Without one, do this before you give up the old one. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- At the code prompt, click Log in another way and use your backup email or security questions (Xero). One article calls it Use another authentication method.
- Change your Xero password, plus your security questions if you use them, as Xero recommends (Xero).
- Connect your new phone as described above.
If the backup method fails too, contact Xero support to reset MFA. You'll need to have tried the backup method several times, give your Xero login email, and prove the account is yours (Xero). Xero's FAQ says someone should be in touch within a few hours (Xero). More in Lost the phone with your authenticator app?
Turning 2FA off
In Account, under Additional security, click the menu icon next to Multi-factor authentication, then Turn off multi-factor authentication. Confirm with a 6-digit code and Confirm, or with your backup method and Disable. If MFA is mandatory for you, Xero asks you to set it up again at your next login (Xero). Removing Xero from Novaz doesn't turn MFA off.
