Stillcode › Two-factor authentication › Heroku
A token Heroku hands out itself, an authenticator app, and the question neither of them answers — what happens to your codes when the phone holding them stops existing.
These are the second factors Heroku offers on heroku.com. Which ones you
see can depend on your plan and your country;
what each of the seven actually costs you is set out once.
| Method | What it is | |
|---|---|---|
| Authenticator app (TOTP) | Supported | Computed on your own device; nothing is sent to produce it. |
| Hardware security key | Supported | A physical key you tap; the one option phishing does not beat. |
| The service’s own app | Supported | Software this service publishes; it works, and only here. |
| The service’s own device | Supported | A token the service issues, and usually only it can replace. |
| SMS text message | Not offered | Texted to your number, so your carrier is part of the lock. |
Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.
Heroku offers no SMS or voice option at all. That is worth noticing rather than skipping past: it removes the SIM-swap route onto the account entirely, and it means an authenticator app is the baseline here, not an upgrade.
A hardware security key is also accepted. It is stronger than any code, because a code can be typed into a convincing fake page and a key cannot. The usual arrangement is a key as the primary factor and an authenticator app as the backup that fits in a pocket.
Heroku also offers a prompt through software it publishes itself. It works, and it works only here: an account secured that way ties you to that software on whatever device you happen to be holding, which is the trade-off an open standard like TOTP exists to avoid.
Of the fifty services on this site, three issue a hardware token of their own,
and Heroku is one of them. No other service here accepts exactly this combination of factors. Among the four services filed under cloud,
two accept a hardware security key —
Heroku among them.
The directory files Heroku under cloud, records four of the seven second
factors it tracks, and points at instructions published at
devcenter.heroku.com/articles/multi-factor-authentication. A second document on the same host, …/recovery-codes,
covers not being able to complete sign-in.
Heroku's own instructions: Heroku — two-factor authentication — linked, never copied, because a stale menu path here locks people out.
Heroku publishes a page for exactly this situation: what to do when you cannot complete two-factor sign-in. ⭐ Read it before you need it — the steps almost always require something you have to set up in advance.
Background: how the codes work · what still works when the phone is gone.
An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store