Zeplin 2FA: how to set up an authenticator app

Design teams use Zeplin to hand off screens and specs to developers, so the account often holds unreleased work. Zeplin calls its two-factor protection multi-factor authentication (MFA), and it has one method: a code from an authenticator app. Zeplin's help says you won't need an SMS or an email to get the code (Zeplin).

There are two ways MFA ends up on your account. You can turn it on yourself, or an Enterprise workspace you belong to can require it, in which case Zeplin asks you to set it up when you log in (Zeplin). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Zeplin steps come from Zeplin's own help center, linked below, which we read on October 21, 2026. We haven't tested them on a Zeplin account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Zeplin's article describes these steps (Zeplin):

1. Log in to the Zeplin web app and click your avatar in the top right corner to open your profile.
2. Open the Account tab.
3. Scroll down to the Multi-factor Authentication section and start the setup there.
4. Zeplin shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. If you can't scan it, Zeplin lets you enter the secret key by hand. In Novaz, tap +, then Enter key manually and paste the key into Setup key. See What is a 2FA setup key?
6. Enter the code Novaz shows to finish.
7. Save the backup codes Zeplin gives you.

Zeplin's help doesn't say how often its codes change or how many digits they have. Scanning the QR code is the safer choice, because it passes those settings to the app. A key typed by hand always gives 6-digit codes every 30 seconds.

The article doesn't name the buttons in each step, so follow what the screen asks for.

Keep the backup codes

Zeplin gives you backup codes during setup. A backup code gets you into your account and lets you remove MFA, and then you can set it up again (Zeplin). Zeplin's help doesn't say how many codes you get or whether you can make new ones later.

They're your way back in if you lose the phone and have no Novaz backup (iCloud backup or a backup file), or if you added Zeplin after your last backup file. Store them in a password manager or on paper, away from your phone. More in 2FA backup codes.

When Zeplin asks for a code

Once MFA is on, Zeplin asks for a code from your authenticator app every time you log in (Zeplin).

In an Enterprise workspace, the Owner or an Admin sets the authentication policy and a session duration on the Authentication page of the Workspace Settings. When that session runs out, Zeplin logs members out and asks for MFA again. The authenticator requirement covers members who don't sign in through the company's SAML/SSO, such as external collaborators (Zeplin).

If you log in with Google, Zeplin says your Google account's own 2-step verification applies to the Zeplin login as well (Zeplin).

If Zeplin rejects your code

Zeplin's advice is about time. It points out that each code is only valid for a short window, so type it before it changes, and its fix for failing codes is a time sync inside Google Authenticator (Zeplin). Novaz has no such menu. It uses the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Zeplin has a reset option for the authenticator app in the same Multi-factor Authentication section of the Account tab. Choosing it means going through the setup again, this time with the new phone (Zeplin). Do it while the old phone still shows codes.

With a Novaz iCloud backup or backup file, you can skip the reset and restore your accounts on the new iPhone instead. Without one, a new iPhone means adding Zeplin again. See How to transfer your authenticator app to a new iPhone.

The reset and remove options exist only for individual MFA. If an Enterprise workspace Admin or Owner manages your security settings, you won't see them (Zeplin).

If you lose your authenticator

1. Use a backup code. Log in with it, remove MFA, then set it up again with your new authenticator.
2. No backup codes, personal MFA: email support@zeplin.io. Zeplin's help doesn't list what proof it asks for.
3. No backup codes, MFA required by your workspace: ask your workspace Owner or Admin to email support@zeplin.io and request an MFA reset for you (Zeplin).

Plan for a wait: Zeplin says "MFA recovery may take several days if Zeplin support is needed" (Zeplin). More in Lost the phone with your authenticator app?

Turning 2FA off

Open your profile, go to the Account tab, and scroll to Multi-factor Authentication, where Zeplin offers the option to remove MFA (Zeplin). If your workspace requires MFA, the option isn't there. After removing it, you can delete the Zeplin entry in Novaz: open it and tap Remove account.

Official Zeplin help

• Getting started with Individual MFA
• Getting started with MFA (Enterprise workspaces)
• Google SSO with Zeplin