Authenticator App - Novaz

Xero 2FA: How to Set Up an Authenticator App

xero.com SupportedChecked against official help · September 26, 2026

Your Xero login opens your organisation's accounting data, so a password alone is thin protection. Xero calls the feature multi-factor authentication (MFA) and lets you choose the authenticator app you want to use, such as Authenticator App - Novaz. Xero's own Xero Verify app adds push notifications if you want them.

A Xero account can be tied to your money and personal finances, so a stolen password is a direct financial risk. Besides an authenticator app, Xero also offers a proprietary app. An authenticator app (TOTP) is usually the best balance of security and convenience.

2FA methods Xero supports

  • Authenticator app (TOTP)
  • Proprietary app

Before you start

  • Your own Xero user login: MFA is set per user and can't be turned on for a whole organisation or practice
  • Xero open in a web browser, since you can't set up MFA in the Xero Accounting app
  • Authenticator App - Novaz installed on your iPhone or iPad, with internet access
  • A backup email address, or answers for backup security questions (letters and numbers only, at least 5 characters)
Download on the App Store

Part 1: Turn on 2FA in Xero

  1. 1

    Open your Xero Account page

    Log in to Xero in a web browser, click your initials or profile image and select "Account". On a phone browser, open the menu icon first.

  2. 2

    Click Set up next to Multi-factor authentication

    Click "Set up" next to "Multi-factor authentication". Xero may also offer "Set up multi-factor authentication" straight after you log in; both lead to the same steps.

  3. 3

    Choose an app

    Choose to use an authenticator app. Xero shows a QR code; keep it on screen while you pick up your phone.

Part 2: Add Xero to Authenticator App - Novaz

  1. 4

    Scan the QR code with Authenticator App - Novaz

    Open Authenticator App - Novaz, tap the + button and scan the QR code. If Xero is open on the same device as the app, choose to enter a key instead and type the setup key Xero shows, with your email as the account name. Tap "Save".

  2. 5

    Note the one-time code

    Authenticator App - Novaz now shows a one-time code for Xero. It changes every 30 seconds, so have the current one ready.

Part 3: Confirm and finish

  1. 6

    Enter the code from the app

    When Xero asks for it, enter the current code from Authenticator App - Novaz.

  2. 7

    Add a backup email

    Add a backup email address and click "Continue", then enter the code Xero emails you. If you prefer, choose "Add backup security questions" instead.

If something goes wrong

  • Xero rejects the code: make sure your iPhone sets its date and time automatically (Settings > General > Date & Time), then enter the newest code.
  • You're locked out after wrong codes: after 5 failed attempts Xero locks the account for 15 minutes. Wait, then try again with the newest code.
  • You can't find the setting in the Xero app: MFA can only be set up in a web browser, not in the Xero Accounting app.
  • You want MFA for your whole practice: MFA is set per user, so each person turns it on for their own Xero login.

Checked against Xero's own help pages on September 26, 2026. Menu names can change, so these pages have the current path:

How to recover your Xero account

If you lose the phone with Authenticator App - Novaz, choose "Log in another way" at the code prompt and use your backup email or security questions. Once you're in, change your password (and your security questions if you use them), then set up MFA again with Authenticator App - Novaz on your new phone. If you still can't get in, contact Xero to reset MFA: you need to have tried your backup method first, give your Xero user email on the contact form and prove you own the account. Xero's help doesn't mention backup codes.

Frequently asked questions

Which authenticator apps work with Xero?
Xero Central says: "You can choose the authenticator app you want to use." Xero names Google Authenticator and FreeOTP, and Authenticator App - Novaz works the same way. Xero Verify is Xero's own app and adds push notifications.
Can I use Xero MFA on two phones?
No. Xero says MFA works on only one device, so moving to a new phone means setting it up again there.
Can I set up MFA in the Xero mobile app?
No. Xero says you can't set it up in the Xero Accounting app. Use a web browser, on a computer or a phone.
What happens after too many wrong codes?
After 5 failed attempts Xero locks the account for 15 minutes. Check the time on your phone and use the newest code.

Generate your Xero codes in Authenticator App - Novaz

Free, offline, and encrypted. One tap for every 6-digit code.

Get the app

More Finance guides

Novaz is not affiliated with, endorsed by, or sponsored by Xero. Xero and its logo are trademarks of their respective owner and are used here for identification only.