Zoho 2FA: how to use an authenticator app instead of OneAuth

Your Zoho account is the sign-in for Zoho Mail and Zoho's other apps. Zoho calls two-factor authentication multi-factor authentication (MFA), and its help pages keep steering you to OneAuth, Zoho's own app. You don't have to use it. The OTP Authenticator mode works with any authenticator app, and Zoho's setup screen says so: "You can use any authenticator app to scan the QR code." (Zoho)

MFA is optional on a personal account. On a company account, an admin can require it and limit which modes you may use (Zoho). The modes are OneAuth, an OTP authenticator and a security key. Accounts created after January 1, 2024 don't get text-message codes (Zoho). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Zoho steps come from Zoho's own help center, linked below, which we read on October 20, 2026. We haven't tested them on a Zoho account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

What OneAuth does that a plain authenticator app doesn't

With OneAuth, you can approve a push notification or scan a QR code instead of typing a code, add a Face ID or Touch ID check, and skip the password with passwordless sign-in. It also signs you in to all of Zoho's mobile apps at once, and you can recover your account with a passphrase (Zoho).

An app like Novaz only shows a code: you type your password, then the code. Novaz's keys stay on the iPhone unless you turn on iCloud backup or export a backup file, so your backup codes matter more. You can also set up both and choose at sign-in (Zoho).

Turn on 2FA with an authenticator app

Zoho's steps (Zoho):

1. Sign in at accounts.zoho.com and click Multi-Factor Authentication in the left menu.
2. Under OTP Authenticator, click Set up Now. Zoho shows a QR code and a text key, which it calls the secret. In Zoho's screenshot, the window also tells you to get OneAuth; you can ignore that.
3. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. Click Next, type the code from Novaz, and click Verify.

If you can't scan, use the secret, shown under MANUAL ENTRY in Zoho's screenshot (Zoho). In Novaz, tap +, then Enter key manually, and type it as the Setup key, without the spaces. See What is a 2FA setup key? Zoho doesn't say how many digits its codes have or how often they change, so scanning is safer: the QR code carries those settings.

If you also use OneAuth and want Novaz to be the default, click MAKE PRIMARY next to the OTP authenticator, then Confirm.

Save your backup verification codes

Zoho's backup codes are 12 digits, and each works once. Zoho shows them only when you create them, and a new set cancels the old one. Open Multi-factor Authentication, click MFA Recovery Options, then Generate new codes, and copy or download them (Zoho). A company admin can hide this option.

They get you in if the phone is lost and you have no Novaz backup, or your backup file is older than your Zoho account in Novaz. Keep them in a password manager or on paper, away from your phone. See 2FA backup codes.

When Zoho asks for a code

At every sign-in, unless you click TRUST when Zoho offers to remember the browser. Then it won't ask there for 180 days, or less if your admin says so. Private windows and cookie cleaners undo the trust (Zoho).

If you read Zoho Mail in Outlook or another mail app, your password stops working there once MFA is on. Under Security, go to App passwords, click Generate New Password, and use that instead (Zoho).

If Zoho rejects your code

Zoho says to make sure your phone sets its time automatically, then try the next code, since yours may have expired (Zoho). On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. See Authenticator code not working?

Changing phones

While you can still sign in, open Multi-Factor Authentication, click Change Configuration under the OTP authenticator, and follow the steps with the new phone (Zoho). Do it before you give up the old phone, unless you have a Novaz iCloud backup or backup file: then you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Zoho lists three ways back in (Zoho):

• A trusted browser, which won't ask for a code.
• Another MFA mode: click Problem signing in? at the code step.
• A backup code: click Can't access your device? (after Problem signing in? if you have other modes), then Use backup verification codes (Zoho).

Once in, set up the authenticator again and make new backup codes.

Without any of these, email support@zohoaccounts.com. Zoho checks who you are, then gives you a one-time backup code (Zoho). Its help doesn't say what proof it asks for or how long it takes. On a company account, your admin can reset MFA for you (Zoho). More in Lost the phone with your authenticator app?

Turning 2FA off

To remove just the authenticator, open Multi-Factor Authentication, point at it, click the trash can icon, then Confirm (Zoho). To turn MFA off entirely, use the toggle at the top right of MFA modes. Your backup codes stop working, and turning MFA back on means new codes and new app passwords. If your admin enforces MFA, there's no toggle (Zoho).

Official Zoho help

• OTP Authenticators
• How do I set up Google/Microsoft/Authy authenticator for my Zoho account?
• Introduction to multi-factor authentication (MFA)
• Multi-Mode MFA
• Introduction to OneAuth
• Backup Verification codes
• Trusted Browsers
• Security
• Troubleshoot sign-in related issues
• Recover your Zoho account
• Disable/Re-enable Multi-factor Authentication