Stillcode › Two-factor authentication › Netlify

Two-factor authentication on Netlify

Netlify sends you nothing: no text, no call, no mailbox fallback. What that leaves you holding, where its own instructions are, and what happens when the device holding your codes is gone.

What Netlify supports

These are the second factors Netlify offers on netlify.com. Which ones you see can depend on your plan and your country; what each of the seven actually costs you is set out once.

MethodWhat it is
Authenticator app (TOTP)SupportedComputed on your own device; nothing is sent to produce it.
Hardware security keyNot offeredA physical key you tap; the one option phishing does not beat.
SMS text messageNot offeredTexted to your number, so your carrier is part of the lock.

Data sourced from 2FA Directory by 2factorauth. Snapshot 2026-09-24.

What that particular mix means

Netlify offers no SMS or voice option at all. That is worth noticing rather than skipping past: it removes the SIM-swap route onto the account entirely, and it means an authenticator app is the baseline here, not an upgrade.

Where this page's facts come from

Of the fifty services on this site, twelve send you nothing at all — no text, no voice call, no email fallback, and Netlify is one of them. Five of the fifty accept exactly this combination, so the same decision comes up on four other services here. Among the three services filed under hosting, one accepts a hardware security key — Netlify not among them.

The directory files Netlify under cloud and hosting, records one of the seven second factors it tracks, and points at instructions published at docs.netlify.com/accounts-and-billing/user-settings/#two-factor-authentication-2fa.

Switching on an authenticator app

Netlify's own instructions: Netlify — two-factor authentication — linked, never copied, because a stale menu path here locks people out.

If the phone holding your Netlify codes is gone

Netlify publishes no dedicated page for losing your second factor, which in practice means the route back is ordinary account recovery: proving who you are to support, on their timetable.

Background: how the codes work · what still works when the phone is gone.

Other services in the same place

GitHub GitLab Bitbucket Atlassian

Where Stillcode fits

An iPhone, iPad and Mac authenticator for these codes that makes no network calls at all. What is free and what Pro adds. Get it on the App Store