Authenticator App - Novaz

Cloudflare 2FA: How to Set Up an Authenticator App

cloudflare.com SupportedChecked against official help · September 25, 2026

Your Cloudflare login controls your domains, DNS records and security settings, so one leaked password could put your websites at risk. Cloudflare calls the feature two-factor authentication (2FA), and its "Mobile App Authentication" option works with time-based codes from an authenticator app such as Authenticator App - Novaz.

A Cloudflare account is part of your security setup, so it deserves strong 2FA of its own. Besides an authenticator app, Cloudflare also offers security keys. An authenticator app (TOTP) is usually the best balance of security and convenience. For the strongest protection, Cloudflare also supports hardware security keys.

2FA methods Cloudflare supports

  • Authenticator app (TOTP)
  • Security key (U2F / WebAuthn)

Before you start

  • Your Cloudflare email address and password (Cloudflare asks for the password twice during setup)
  • A verified email address on your Cloudflare account: turning on 2FA without one may lock you out
  • If you signed up with Apple, Google or GitHub, a password set through "Forgot Password" first, because enabling 2FA requires one
  • Authenticator App - Novaz installed on your iPhone or iPad
  • The Cloudflare dashboard open on a computer, and a safe place for your backup codes
Download on the App Store

Part 1: Turn on 2FA in Cloudflare

  1. 1

    Open My Profile

    Log in to the Cloudflare dashboard at dash.cloudflare.com. Open the "My Profile" dropdown and select "My Profile".

  2. 2

    Go to Authentication

    Select "Authentication". Under "Two-Factor Authentication", select "Set up".

  3. 3

    Add Mobile App Authentication

    Under "Mobile App Authentication", select "Add". Cloudflare shows a QR code; leave the page open while you pick up your phone.

Part 2: Add Cloudflare to Authenticator App - Novaz

  1. 4

    Add Cloudflare in Authenticator App - Novaz

    Open Authenticator App - Novaz, tap the + button and scan the QR code. If it won't scan, select "Can't scan QR code, Follow alternative steps" on Cloudflare, choose to enter a setup key in the app and type the key exactly as shown. Check the account name, then tap "Save".

  2. 5

    Note the code

    Authenticator App - Novaz now shows a code for Cloudflare. It changes every 30 seconds, so have it ready for the next step.

Part 3: Confirm and finish

  1. 6

    Enter the code and your password

    Back on Cloudflare, enter the code from Authenticator App - Novaz, enter your Cloudflare password and select "Next". When Cloudflare asks, enter your password again.

  2. 7

    Save your backup codes

    Select "Next" to review your backup codes, then select "Download", "Print" or "Copy" and store them somewhere safe. Select "Next" on the backup code page to finish. Two-factor authentication is now on.

  3. 8

    Know when Cloudflare will ask for a code

    From now on, Cloudflare shows a "Two-Factor Authentication" page after your email and password, where you enter the code from Authenticator App - Novaz. With Apple, Google or GitHub login, this step comes on top of that provider's own check.

If something goes wrong

  • Cloudflare rejects the code: make sure your iPhone sets its date and time automatically (Settings > General > Date & Time), then enter the newest code.
  • You can't turn 2FA on: check that your email address shows "(verified)" under "My Profile". If not, select "Send verification email" and open the link first.
  • Cloudflare shows "Insert your security key and touch it" at login: cancel the browser prompt and select "try another authentication method or backup code".
  • You were invited to an account with "2FA Enforcement" on: you must turn on 2FA before accepting the invitation, and you may not be allowed to turn it off later.

Checked against Cloudflare's own help pages on September 25, 2026. Menu names can change, so these pages have the current path:

How to recover your Cloudflare account

Cloudflare gives you single-use backup codes during setup: after your email and password, enter one in the text box on the "Two-Factor Authentication" page. For a fresh set, go to "My Profile" > "Authentication", select "Manage" and then "Regenerate" next to Backup codes; the old codes stop working. If you've lost your phone and your backup codes, select "Try recovery" next to "Lost all 2FA devices and backup codes?", then "Begin recovery". Enter the access code Cloudflare emails you, select "Verify email", then "Verify device" on a computer you've logged in from before. If you see "Device verified", Cloudflare emails instructions within 3–5 days, which can't be sped up. If verification fails, follow "Request manual verification".

Frequently asked questions

Why does Cloudflare need a verified email first?
Cloudflare only lets you enable 2FA on an account with a verified email address, and warns that you could lock yourself out otherwise. A verified address shows "(verified)" under "My Profile".
Will Cloudflare still email me login codes?
Without 2FA, Cloudflare emails a one-time code when you log in from an unrecognized IP address. Only enabling two-factor authentication turns that email check off, so after setup you'll use Authenticator App - Novaz instead.
How do I move Cloudflare to a new phone?
Repeat the "Mobile App Authentication" setup with Authenticator App - Novaz on the new phone. Your previous codes stop working, but 2FA stays on.
Can I add more than one 2FA method?
Yes. Cloudflare also supports security keys, built-in authenticators such as Touch ID or Windows Hello, and email codes, and recommends enabling at least two methods.

Generate your Cloudflare codes in Authenticator App - Novaz

Free, offline, and encrypted. One tap for every 6-digit code.

Get the app

More Security guides

Novaz is not affiliated with, endorsed by, or sponsored by Cloudflare. Cloudflare and its logo are trademarks of their respective owner and are used here for identification only.