Do I need the IBM Verify app for IBMid?

No. IBM Verify is one choice, but IBMid also offers “Authenticator app”, which IBM says works with Duo, Google Authenticator, Microsoft Authenticator and other apps following the same standard. The Authenticator extension is one of them and reads the QR code straight off the IBMid page.

What if I lose access to my authenticator?

Sign in with your email as the second step, then remove the lost method in your security settings — hover over it, click the three dots and choose “Delete” — and add the authenticator again. If that does not work, IBM asks you to email IBMid support with a description of the problem.

IBMid says “The user account is locked”. What now?

After five wrong passwords in a row an IBMid is locked for 30 minutes, then unlocks by itself — or reset your password to unlock it sooner. If the error comes after the second step, IBM’s help says the usual cause is a method that no longer works, and the fix is a ticket with IBMid support.

Why does IBMid say my code is wrong?

Usually the computer clock is off by a minute or more — IBM’s help names time as the usual cause, including when IBMid sends you back to the sign-in page after the code. Turn on automatic date and time and try the next code. If it still fails, remove the authenticator from your security settings and add it again.

IBMid Authenticator App — Set Up Multifactor Authentication

Your IBMid signs you in to IBM Cloud, My IBM, IBM support and the IBM software your company uses, so its password guards more than one service. IBM makes multifactor authentication mandatory for every IBMid. IBM Verify, a passkey or an email code all satisfy it; an authenticator app keeps the code on your own device, with no waiting for an email.

Add an authenticator app to your IBMid

IBM recommends setting up more than one method, so that losing a device does not lock you out. If your company signs you in to IBM through its own login (a federated IBMid), IBM sends you to that login instead of asking for your IBMid password, and the second step belongs to your company’s system.

Sign in with your IBMid on your computer — at myibm.ibm.com, for example.
If no second step is set up yet, IBMid asks you to choose one right after your password. To add one later, open your IBMid security settings at login.ibm.com/usc/settings/security and click “Add new methods”.
Choose “Authenticator app”.
Give the method a name — IBM suggests naming it after the app, such as “Authenticator extension” — and click “Proceed enrollment”.
IBMid shows a QR code. Leave it on the screen and add it to the extension as described below — then enter the six-digit code from the extension to finish.

IBMid’s own instructions

Add IBMid to Authenticator

Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
Leave the IBMid page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
Go back to IBMid and type the current code into the confirmation field. If it is about to expire, wait for the next one.
IBMid confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.

No QR code, or it will not scan? Look for the option to enter a key manually on IBMid’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.

Get 2FA Authenticator for Chrome — free

Plan a way back into your IBMid

IBM’s IBMid help does not describe backup codes. Its advice is a second method: add your email address as another way to verify, so that if the authenticator is ever lost you can sign in with an email code and remove the old method from your security settings. A recovery email in your IBMid profile helps with password resets, and the extension’s automatic backups keep the codes themselves safe.

The code is not accepted?

Almost always the computer’s clock. The codes are calculated from the current time, so a clock that is a minute off produces codes that look right and are refused. Turn on automatic date and time in your system settings — step-by-step for Windows, macOS and Linux.

If the clock is right, check the key itself: paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.

Questions

Do I need the IBM Verify app for IBMid?: No. IBM Verify is one choice, but IBMid also offers “Authenticator app”, which IBM says works with Duo, Google Authenticator, Microsoft Authenticator and other apps following the same standard. The Authenticator extension is one of them and reads the QR code straight off the IBMid page.
What if I lose access to my authenticator?: Sign in with your email as the second step, then remove the lost method in your security settings — hover over it, click the three dots and choose “Delete” — and add the authenticator again. If that does not work, IBM asks you to email IBMid support with a description of the problem.
IBMid says “The user account is locked”. What now?: After five wrong passwords in a row an IBMid is locked for 30 minutes, then unlocks by itself — or reset your password to unlock it sooner. If the error comes after the second step, IBM’s help says the usual cause is a method that no longer works, and the fix is a ticket with IBMid support.
Why does IBMid say my code is wrong?: Usually the computer clock is off by a minute or more — IBM’s help names time as the usual cause, including when IBMid sends you back to the sign-in page after the code. Turn on automatic date and time and try the next code. If it still fails, remove the authenticator from your security settings and add it again.

Your codes, one click from the login page

Authenticator keeps your 2FA codes in the browser, on your device only — free to use, open source, no account and no phone needed. Local backups and optional password protection come built in.