Setting Up Two-Factor Authentication and Recovery Codes

Why Set Up 2FA?

Two-factor authentication (2FA) adds a second verification step to your login. Even if someone learns your password, they cannot sign in without the rotating code from your authenticator app. We strongly recommend turning it on as soon as you create your account.

Step-by-Step Enrollment

1. Sign in to NivoaFlow and open Settings > Security
2. Select Enable Two-Factor Authentication
3. Open an authenticator app on your phone — Google Authenticator, Authy, Microsoft Authenticator, 1Password, or Bitwarden all work
4. Scan the QR code on screen with your authenticator app. If you cannot scan, tap Enter code manually and copy the secret string into your app
5. Your authenticator will start displaying a six-digit code that refreshes every 30 seconds. Type the current code into NivoaFlow and select Verify
6. Save your recovery codes — see the next section

That is the full setup. The next time you sign in, NivoaFlow will ask for a six-digit code after your password.

Saving Your Recovery Codes

After you verify your authenticator, NivoaFlow shows a list of one-time recovery codes. These are your safety net if you ever lose access to your authenticator app.

• Save them somewhere you can reach without your phone — a password manager, a printed copy in a secure drawer, or both
• Each code can be used once to sign in
• Treat them like passwords — do not share them, and do not store them in plain text on the device you use to sign in
• If you run low, generate a new set from Settings > Security. Generating new codes invalidates the old ones

If You Lose Your Device

If your phone is lost, stolen, or wiped:

1. On the sign-in screen, enter your email and password as usual
2. When prompted for a 2FA code, choose Use a recovery code
3. Enter one of your saved recovery codes — this signs you in for the current session
4. Open Settings > Security and select Reset 2FA. This removes the old authenticator pairing
5. Re-enrol with your new device by following the steps above

Trusted Device Behaviour

When you sign in from a personal device, you can tick Trust this device for 3 days. While the device is trusted, NivoaFlow will not ask for a 2FA code on subsequent logins from the same browser. After three days, or if you clear cookies, sign out, or change your password, the trust expires and you will be prompted again. We do not recommend trusting shared or public devices.

If You Lose All Recovery Codes

If you no longer have your authenticator and you have used or misplaced every recovery code, contact us at support@nivoaflow.com from the email address on your account. For your protection we will ask you to verify your identity before disabling 2FA. This process can take a few business days, so we strongly recommend storing recovery codes safely the moment you enrol.

For more on our security practices, see data security overview.