Skip to content
Novaz AuthenticatorGET

Zerodha Kite 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. You'll use this code every trading day
  2. Turn on 2FA with an authenticator app
  3. No backup codes
  4. If Kite says Invalid TOTP
  5. Changing phones
  6. If you lose your authenticator
  7. Turning it off
  8. Official Zerodha help

Zerodha Kite is the Indian broker's trading platform, on the web and as an app. Two-factor authentication (2FA) is mandatory. After your password, Kite web asks for either the App Code shown in the Kite app on your phone, or a code from an authenticator app, which Zerodha calls external TOTP (Zerodha). The Kite app itself uses an SMS or email OTP the first time, then your phone's device lock (Zerodha).

An authenticator app suits you if you don't use the Kite app, or don't want your login to depend on it. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Zerodha steps come from Zerodha's own support portal and its Z-Connect blog, including the screen recordings in the help articles, linked below, which we read on October 20, 2026. We haven't tested them on a Zerodha account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

You'll use this code every trading day

Regulations log everyone out at the end of each day, so you sign in to Kite daily (Zerodha). Once external TOTP is on, Zerodha's blog says both Kite web and the Kite app ask for the authenticator code when you log in (Zerodha), and Kite web no longer needs the App Code (Zerodha). You have 5 minutes after entering your password to type it in (Zerodha).

Turn on 2FA with an authenticator app

Zerodha's codes are 6 digits and change every 30 seconds. On Kite web (Zerodha):

  1. Log in at kite.zerodha.com, click your Client ID at the top right, then My profile / Settings.
  2. Click Password & Security. Under External 2FA TOTP, click Enable external TOTP.
  3. Zerodha emails you an OTP. Enter it and click Verify.
  4. Kite shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it.
  5. If you can't scan it, click Can't scan? Copy key. The key appears under the QR code. In Novaz, tap +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
  6. Type the 6-digit code from Novaz, enter your Kite password, and click Enable.

In the Kite app, tap Client ID > Profile > Manage > Enable external TOTP; the key link there reads Can't Scan? Copy the Key. On the same iPhone, copy the key into Novaz, or screenshot the QR code and use Choose a photo (scanning a QR code on the same iPhone).

Zerodha's screen recording shows Kite then asking you to log in again on all your devices.

No backup codes

Zerodha's help doesn't mention backup or recovery codes. For lost phones, it suggests Authy, which backs up codes across devices (Zerodha). Novaz can keep a copy too, through iCloud backup or a backup file. Without one, your fallback is the password reset below, so keep your registered email and mobile number current.

If Kite says Invalid TOTP

Zerodha says this means your phone's clock is out of sync. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically (Zerodha). Novaz also warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Don't keep guessing: 5 wrong 2FA entries block the account, and unblocking it means a password reset, which logs out every session (Zerodha).

If a code won't go through on Kite web, click Problem with Mobile App Code?, wait 15 seconds, and choose SMS/email OTP instead (Zerodha).

Changing phones

Zerodha has no page on this. While the old phone works, disable external TOTP, then enable it again with the new iPhone. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone, and Kite keeps accepting the codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Zerodha's fix is to reset your password and set up TOTP again (Zerodha):

  1. On Kite, choose Forgot user ID or password? and enter your User ID and PAN.
  2. Choose Receive on Email or SMS, enter your registered email address or mobile number and the captcha, then Reset.
  3. Enter the OTP, then a new password, and Continue.
  4. Choose Method 2: External authenticator, then Setup TOTP, and add Kite to Novaz again. Enter the code in Enter the 6 digit app TOTP and click Continue.

NRI account holders get no SMS OTPs and use email (Zerodha). If you can't reach your registered email or mobile, you must first update them with a signed account modification form and In-Person Verification, which Zerodha says takes up to 72 working hours after verification (Zerodha). More in Lost the phone with your authenticator app?

Turning it off

On Kite web, go to Client ID > My profile / Settings > Password & Security, click Disable external TOTP, enter your password and click Disable (Zerodha). Kite web then goes back to the App Code. In Novaz, open the entry and tap Remove account.

Official Zerodha help

More guides: Investing and brokerage