Turn on two-step verification and add a passkey

Ask for a second check after your password, set up an authenticator app, save backup codes, add a passkey to sign in with your fingerprint or face, and choose which method Nova tries first.

Select your picture or initials at the right end of the top bar, then select Security in your account menu. The page, headed My Security, is at /profile/security. Everything below is on that page.

Two-step verification means Nova asks for a second proof after your password: a code from an app, a text or an email, or a passkey. Someone who learns your password still cannot get in.

Steps

1. Under Authenticator app, select Set up an app. An authenticator app on your phone gives the safest codes.
2. Open your authenticator app on your phone, choose to add an account, and scan the square code. If you cannot scan it, open Can’t scan it? under the code and type the key into the app, or press Copy key.
3. Type the 6-digit code your app shows and select Finish setup.
4. Under Two-factor authentication, select Turn on. The card turns green and reads On.
5. Under Backup codes, select Create backup codes. In Save your backup codes, select Show backup codes, then Copy, Download or Print them, and select I've saved them. Each code works once if you ever lose your phone.
6. To sign in with your fingerprint, face or device PIN, go to Passkeys on the computer or phone you use and select Add passkey on this device. Follow your browser's prompt. Repeat on each device.
7. Under Verification methods, the Preferred method is the one Nova tries first. Select Change to pick another.

What you see

• Your authenticator apps and passkeys are listed with the date each was last used. Use the pencil to rename one (for example "Work laptop") and the bin to remove it.
• Text and email codes use the verified phone and email on your Contacts tab. Add or verify them there (Add, verify or change your email and phone).
• From now on, Nova asks for the second step when you sign in, unless you told it to remember that device.

If something looks different

• Turn off is greyed out and the card says it is required: your company requires two-step verification for everyone (Require two-factor authentication for your team).
• Turn on says to set something up first: add an authenticator app or a passkey, or verify your email or mobile number, then try again.
• Turning it off asks you to confirm Turn off two-factor and to prove it is you. Your apps, passkeys and backup codes stay saved. Ordinary sign-ins in the browser and Android then follow your choice; a company requirement or an unusual sign-in can still need a check. An unfinished sign-in started before the change must be started again.
• Add passkey on this device is greyed out with a note about a supported browser: your browser cannot save passkeys. Try an up-to-date Chrome, Edge, Safari or Firefox.
• The backup codes button reads Replace backup codes: you already have a set. Making a new set cancels the old codes.
• Lost your phone and your codes? Your admin can reset your two-step verification.