How to Set Up an Authenticator App for GitHub
If you manage code on GitHub, an authenticator app is one of the simplest ways to add strong two-factor authentication to your account.
This guide explains how to set up authenticator app for GitHub, what to expect during enrollment, and how to avoid common mistakes that lock people out.
What an authenticator app does for GitHub security
An authenticator app generates time-based one-time passwords, often called TOTP codes, that change every 30 seconds.
When you sign in to GitHub with your password, you enter one of these codes as a second verification step, which helps protect your account even if your password is stolen.
GitHub supports authenticator apps as part of its two-factor authentication options, alongside security keys and passkeys.
For many users, an authenticator app is a practical balance of security, portability, and ease of use.
- Common authenticator apps: Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and Duo Mobile.
- Best use case: Personal accounts, developer workflows, and teams that need a reliable second factor without extra hardware.
- Security benefit: Codes are generated locally on your device and are valid only for a short time.
Before you begin
Before enabling two-factor authentication on GitHub, make sure you can access the device where your authenticator app is installed.
You should also be signed in to your GitHub account and have a backup plan in case your phone is lost or replaced.
- Install an authenticator app on your phone or tablet.
- Confirm your GitHub account has a verified email address.
- Prepare backup codes or an alternate second factor.
- If you use GitHub Enterprise, check whether your organization has additional security requirements.
How to set up authenticator app for GitHub
GitHub makes the setup process straightforward.
The exact labels may vary slightly depending on whether you are using the web interface or mobile web, but the flow is consistent.
1. Open GitHub security settings
Sign in to GitHub, open your profile menu, and go to your account settings.
From there, select the security section and find the two-factor authentication controls.
GitHub may display this as “Password and authentication” or a similarly named security page.
2. Start two-factor authentication setup
Choose the option to enable two-factor authentication.
GitHub will present available methods, and you should select an authenticator app.
This begins the TOTP enrollment process and generates a QR code and manual setup key.
3. Add the GitHub account to your authenticator app
Open your authenticator app and choose the option to add a new account.
Scan the QR code shown by GitHub if your app supports camera scanning.
If scanning is not possible, enter the setup key manually.
- QR code method: Faster and less error-prone.
- Manual key method: Useful if your camera is unavailable or the QR code will not scan.
4. Enter the verification code in GitHub
After your account is added, the authenticator app will display a six-digit code.
Type that code into GitHub to confirm the setup.
Because these codes rotate quickly, enter it before it expires and request a fresh code if needed.
5. Save backup codes and recovery options
Once GitHub confirms the authenticator app, download or print your backup codes and store them somewhere secure.
Backup codes are critical if your phone is unavailable, your app is reset, or you switch devices unexpectedly.
For additional resilience, consider adding a second security key or passkey where supported.
GitHub’s account recovery process is much easier when you have multiple recovery methods configured in advance.
How to sign in with GitHub after setup
After two-factor authentication is enabled, your GitHub sign-in flow changes slightly.
You will enter your password first and then provide the code from your authenticator app when prompted.
- Open GitHub and enter your username and password.
- Retrieve the current six-digit code from your authenticator app.
- Enter the code before it expires.
- If you copied the code from another device, ensure the clocks on both devices are accurate.
Some apps also support autofill or built-in password manager integration, which can make the process faster while still preserving the security benefits of TOTP.
Troubleshooting common setup issues
Most authenticator app problems on GitHub come from synchronization, device access, or setup key errors.
The good news is that many of them are easy to fix if you know where to look.
The QR code will not scan
If your camera cannot scan the QR code, switch to the manual setup key method.
Make sure the screen brightness is high enough and the code is fully visible without glare or cropping.
The code is marked invalid
An invalid code usually means the time on your device is out of sync, the code expired, or the setup was entered incorrectly.
Check that automatic time settings are enabled on your phone, then try the latest code shown in the app.
You lost access to the authenticator app
If you replaced your phone or removed the app without migrating your account, use your GitHub backup codes or another configured second factor.
If neither is available, account recovery may require additional verification through GitHub support or your organization administrator.
Your organization requires stronger authentication
In GitHub organizations and enterprise environments, administrators may require security keys, passkeys, or specific authentication policies.
If your organization has enforced controls, an authenticator app may be allowed as an additional method but not the only method.
Security best practices for GitHub users
Setting up an authenticator app is only one part of securing a GitHub account.
Developers, maintainers, and contributors should combine it with strong password hygiene and careful device management.
- Use a unique password stored in a password manager.
- Keep backup codes offline and separate from your phone.
- Review connected SSH keys, deploy keys, and OAuth apps regularly.
- Enable notifications for suspicious sign-in activity if available.
- Prefer passkeys or security keys where your workflow and organization allow them.
These steps matter because GitHub accounts often have access to private repositories, CI/CD pipelines, release workflows, and package registries.
A compromised account can expose code, secrets, and production infrastructure.
Authenticator app vs. security key for GitHub
An authenticator app is easier to adopt than a hardware security key, but the two methods do not provide identical protection.
Authenticator apps are vulnerable to phishing if a user is tricked into entering a valid code on a fake site, while FIDO2 security keys and passkeys are designed to resist that style of attack.
- Authenticator app: Convenient, widely supported, good baseline protection.
- Security key: Strong phishing resistance and strong fit for high-value accounts.
- Passkey: Modern option that can simplify sign-in while improving security.
For many GitHub users, the best approach is to start with an authenticator app and then add a security key or passkey for stronger account recovery and phishing resistance.
What to check after enabling 2FA
After you finish setup, verify that your account settings reflect the new authentication method and that you have a working backup path.
Test a fresh sign-in from another browser or device if possible, then confirm that backup codes are stored safely.
It is also worth reviewing your developer tools and automation setup.
If you use Git, GitHub Desktop, CI platforms, or API-based workflows, make sure any tokens, credentials, and integrations still function after the security change.
- Confirm your authenticator app still generates valid codes.
- Store backup codes in a password manager or secure offline location.
- Document your recovery process for future device changes.
- Update team documentation if you manage shared development accounts or admin access.