Which apps and websites work with an authenticator app?
Last checked
Note
Most big services accept any standard authenticator app, and this guide shows, service by service, where to switch it on.
An authenticator app makes a short code on your phone, usually a new one every 30 seconds. You type it in after your password. Because the code is calculated on your phone, it can’t be stolen by taking over your phone number, which is how text-message codes get stolen.
Most big services accept any standard authenticator app. The standard is called TOTP, short for time-based one-time password. Not every service does, and some push their own app or text messages first.
Sign-in services from the Government of Canada, each read from its canada.ca help page.
Service
Canada Revenue Agency (CRA)
Works with an authenticator app: yes, as one of three options.
The CRA’s help page says multi-factor authentication is mandatory for all CRA account users. The options are a third-party authenticator app, a passcode grid, or phone (text or call). When you register, you are prompted to enrol in two options, but only one is currently mandatory.
The page says to download only from official app stores, and that most reputable, standard authenticator apps should be able to read the QR code the CRA provides.
Search for and download a free third-party authenticator app from a reputable app store.
When you set up this option for your CRA account (one time only), scan the provided QR code with a mobile device when prompted, or manually enter the setup key the CRA provides into the app.
Each time you sign in and are prompted for a passcode, open your authenticator app to get the 6-digit code. The app generates a new passcode every 30 seconds.
Works with an authenticator app: yes, and the page recommends it on a smartphone or tablet.
The page is about GCKey two-factor authentication for IRCC accounts. It says you must use two-factor authentication if you sign in with GCKey only, and that it isn’t required if you use the Sign-In Partner option. You can register a smartphone or tablet (recommended), a desktop or laptop, or an email address.
Sign in or create an account using GCKey › Choose a two-factor authentication method › Use your smartphone or tablet
Sign in to your account, or create one, using GCKey. You will be prompted to register a device or provide your email address for two-factor authentication.
Choose Use your smartphone or tablet. You need an authenticator application, and you can download a free one.
In the authenticator application, scan the QR code or enter the secret key to generate a 6-digit passcode.
On the registration page, enter the 6-digit passcode from your authenticator application.
Save the 5 recovery codes the page shows you after you confirm your method.
Works with an authenticator app: yes, as one of four methods.
The page says you need to enter a security code to confirm your identity each time you access MSCA. You can register an authenticator app, a text message (SMS), a voice message or an MSCA Passcode Grid. The page says this step does not apply to provincial sign-in (Alberta.ca Account and BC Services Card) users.
My Service Canada Account › Account menu › Security settings
Sign in to MSCA, or register for an account if you’re a new user.
Download a free secure authenticator app on your device (smartphone, tablet, laptop or desktop).
The app creates a security code. Enter it on the multi-factor authentication page to confirm your identity.
Well-known services from other companies, each read from its own help page.
Service
Amazon
Works with an authenticator app: yes.
Amazon’s help page says that when you sign up for Two-Step Verification, you can choose to receive the security code by text message or by authenticator app.
Works with an authenticator app: no. Apple uses its own codes.
Apple’s help page describes a six-digit code that appears on your trusted devices or is sent to a trusted phone number. It doesn’t offer an authenticator app option, so Apple Account isn’t one you can set up with one.
Most accounts already have two-factor authentication on. The page also says that if your account was created with it, it can’t be removed.
Settings › your name › Sign-In & Security
Open Settings on your iPhone.
Choose your name, then Sign-In & Security.
Turn on two-factor authentication, if it isn’t already, and follow the onscreen instructions.
Works with an authenticator app: yes, as one of three methods.
Facebook asks you to choose a security key, text-message codes or a third-party authentication app. It also offers 10 recovery login codes for when you can’t use your phone. Its help page says not everyone can see this setting in Accounts Center yet, and gives a second route through Security and Login Settings if you can’t.
Works with an authenticator app: yes, and GitHub recommends it over text messages.
GitHub’s help page says you can configure two-factor authentication using a TOTP app on mobile or desktop, or by text message. It strongly recommends a time-based one-time password (TOTP) application, with security keys as backup methods instead of SMS, and says it is app-agnostic, so you can use any TOTP app you prefer.
Install an authenticator app on your phone or desktop.
In the upper-right corner of any page on GitHub, click your profile picture, then click Settings.
In the Access section of the sidebar, click Password and authentication.
In the Two-factor authentication section, click Enable two-factor authentication.
Under Scan the QR code, scan it with your mobile device’s app. If you can’t scan it, click setup key to see the code, the TOTP secret, and enter it in the app instead.
On GitHub, type the code into the field under Verify the code from the app.
Under Save your recovery codes, click Download, and save the codes in a secure location.
After saving your recovery codes, click I have saved my recovery codes to enable two-factor authentication.
Works with an authenticator app: yes, but Google suggests its own prompts first.
Google’s help page recommends Google prompts as the second step if you don’t sign in with a passkey, and says codes sent by text or call can be vulnerable to phone-number-based hacks. The same page says you can set up an app that creates one-time verification codes for when you have no internet connection or mobile service.
Google Account › Security & sign-in › How you sign in to Google › 2-Step Verification
Open your Google Account and tap Security & sign-in.
Under How you sign in to Google, open your 2-Step Verification settings. Select Turn on 2-Step Verification first if it is off.
Works with an authenticator app: yes, and Instagram recommends it.
Instagram offers three methods: an authentication app, which it recommends, text message, or WhatsApp. Two-factor authentication through an authentication app can only be turned on using the Instagram app for Android and iPhone. Login codes, also called backup codes, are available if you lose your phone.
Two-factor authentication › your account
Select Two-factor authentication, then choose an account.
Choose Authenticator app and follow the on-screen steps.
Works with an authenticator app: yes, and LinkedIn prefers it.
LinkedIn offers two methods: text message (SMS) and an authenticator app. Its help page says LinkedIn recommends the authenticator app as the preferred method.
We haven’t recorded the menu path or the steps, so use the official link for them.
Choose Authenticator app and follow the on-screen steps.
Works with an authenticator app: not that we could find. Pinterest’s help page describes only text-message codes, and when we set up two-factor authentication on 25 October 2026, it offered text messages only.
Pinterest’s help page says: “To set up two-factor authentication, you’ll need to provide your phone number so we can text you a code to log in.”
Works with an authenticator app: yes, but it can only be set up in a web browser on a computer.
Reddit’s help page says you’ll be asked for an additional 6-digit authentication code generated from an app on your phone or device. It says this two-factor authentication is only used when you log in to Reddit with a password: if you use your Google account or Apple ID to log in, you’ll need to set up two-factor authentication through them. It also says that currently you can only enable two-factor authentication by logging into Reddit on your computer’s web browser, and that if you lose your phone or access to the authentication app you used to set things up, you can use your backup codes to log in to your account.
On a computer, log in at reddit.com in a web browser, then go to reddit.com/2fa/enable.
On a computer, log in to Reddit in a web browser.
Go to reddit.com/2fa/enable.
Choose to set up an authenticator app and follow the on-screen steps.
Works with an authenticator app: no. WhatsApp uses its own two-step verification.
WhatsApp’s help page describes two-step verification that uses your phone number, a password or an email address, and says WhatsApp also supports passkeys. It doesn’t offer an authenticator app option, so WhatsApp isn’t one you can set up with one.
X’s help page says you can use any Time-based One Time Password (TOTP) authentication app. The steps below are for iPhone. We haven’t recorded the menu path to this screen.
Tap the box next to Authentication app.
Read the overview, then tap Start.
If prompted, enter your password and tap Verify.
If asked, confirm an email address with the code X sends.
Tap Link app now.
Scan the QR code, then tap Next.
Enter the code from your authenticator app, then tap Verify.
MELKEM Authenticator makes the standard six- and eight-digit codes (TOTP) that authenticator apps use. Of the services above, the Canada Revenue Agency, the IRCC account (GCKey), My Service Canada Account, Amazon, Discord, Facebook, GitHub, Google, Instagram, LinkedIn, PayPal, Reddit, TikTok and X offer an authenticator app option. We use MELKEM Authenticator on our own accounts, including Discord, Facebook, GitHub, Google, Instagram, LinkedIn, Reddit, TikTok and X. Apple Account, Pinterest and WhatsApp don’t offer an authenticator app option. MELKEM Authenticator isn’t affiliated with or endorsed by any of these services.
Tested means we set up MELKEM Authenticator on that service and it worked. It doesn’t mean the service endorses MELKEM.
When the service shows a QR code, scan it with the app. If you can’t scan it, type the setup key instead.
Keep each service’s recovery codes somewhere safe, apart from your phone.
