Can I use Lovable 2FA without a phone?

Yes. Lovable names phone apps like Google Authenticator and Authy, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code off the Lovable settings and generates the codes in Chrome.

What if I lose access to my authenticator?

Use your other enrolled method first. If none is left, contact Lovable Support with proof that the account is yours — the account email, recent project IDs or billing details.

Can a Lovable workspace require 2FA?

Yes, on Enterprise workspaces. With “Require two-factor authentication” on, everyone who opens the workspace — external collaborators included — is sent to “Set up two-factor authentication” first and cannot use the workspace until they enroll. Enrolling once covers every workspace you belong to.

I sign in to Lovable with Google or GitHub. Does 2FA still apply?

Yes. Lovable’s 2FA works the same whether you sign in with email and password or with Google, GitHub, Apple or SSO: the code is asked for after any of them.

Lovable Authenticator App — Turn On Two-Factor Authentication (2FA)

A Lovable account holds every app you have built there — the code, the projects connected to it, the keys you put into them, your credits and your billing. Whoever signs in with your password can read, change or publish all of it. With 2FA on, Lovable also asks for the six-digit code from your authenticator, however you sign in: with a password, Google, GitHub, Apple or SSO.

Turn on two-factor authentication in Lovable

2FA belongs to your account, not to a workspace: set it up once and it counts in every workspace you are in. If you signed in more than a few minutes ago, Lovable may ask you to sign in again before it lets you change 2FA.

Sign in at lovable.dev in Chrome on your computer.
Open “Account settings” → “Security”.
Turn on “Two-factor authentication” and select “Authenticator app (recommended)”.
Follow the instructions on the screen: when Lovable shows a QR code, leave it there and add it to the extension as described below.
Enter the code from the extension and click “Verify & Enable”. The authenticator then appears in your list of 2FA methods.

Lovable’s own instructions

Add Lovable to Authenticator

Install 2FA Authenticator from the Chrome Web Store and pin it to the toolbar, so its icon is one click away.
Leave the Lovable page with the QR code open. Click the Authenticator icon, then “Add Account” → “QR Code” → “Scan QR from screen”.
The account appears in the list with a six-digit code that changes every 30 seconds. Rename it if you like — the name is only for you.
Go back to Lovable and type the current code into the confirmation field. If it is about to expire, wait for the next one.
Lovable confirms that two-factor authentication is on. From now on it will ask for a code when you sign in — click the extension icon and copy it.

No QR code, or it will not scan? Look for the option to enter a key manually on Lovable’s setup screen, copy the key, and add it in the extension with “Add Account” → “Manual” → “Secret Key”.

Get 2FA Authenticator for Chrome — free

Lovable has no backup codes — add a second method

Lovable says outright that it does not provide backup or recovery codes: the methods you enrolled are the only way through 2FA. So it recommends keeping at least two. Add text messages as well in Account settings → Security → Two-factor authentication, and while the QR code is on the screen, scan it with an authenticator on your phone too. Keep the extension’s automatic backups on.

The code is not accepted?

Most often the QR code changed: the website makes a new one each time its setup page is reloaded or opened again, so the account you added first no longer matches. Start the setup again, add the QR code that is on the screen now and type its code in straight away. Two entries for the same website? Use the newest. Other reasons: why codes are refused.

Typed the key in by hand? Paste it into the TOTP code generator and compare the code with the one in the extension. If they differ, the key was copied wrong — add the account again.

Questions

Can I use Lovable 2FA without a phone?: Yes. Lovable names phone apps like Google Authenticator and Authy, but all it checks is the six-digit code, and any standard authenticator produces it. The Authenticator extension reads the QR code off the Lovable settings and generates the codes in Chrome.
What if I lose access to my authenticator?: Use your other enrolled method first. If none is left, contact Lovable Support with proof that the account is yours — the account email, recent project IDs or billing details.
Can a Lovable workspace require 2FA?: Yes, on Enterprise workspaces. With “Require two-factor authentication” on, everyone who opens the workspace — external collaborators included — is sent to “Set up two-factor authentication” first and cannot use the workspace until they enroll. Enrolling once covers every workspace you belong to.
I sign in to Lovable with Google or GitHub. Does 2FA still apply?: Yes. Lovable’s 2FA works the same whether you sign in with email and password or with Google, GitHub, Apple or SSO: the code is asked for after any of them.

Your codes, one click from the login page

Authenticator keeps your 2FA codes in the browser, on your device only — free to use, open source, no account and no phone needed. Local backups and optional password protection come built in.