How to Set Up Instagram Two-Factor Authentication.

The short answer

To set up Instagram two-factor authentication, open Accounts Centre, go to Password and security, tap Two-factor authentication and pick a method. An authentication app is the stronger choice. For a team, have one person switch it on, save the backup codes, then let each colleague add their own phone as a separate device.

Why Instagram two-factor authentication is a team problem

For one person, two-factor authentication is a five-minute job. For a brand account run by several people, it is where most of the friction lives.

Once it is on, Instagram asks for an extra code whenever someone logs in from a device or browser it does not recognise. That is the point. It is also why a team that set it up on one person’s phone ends up messaging that person every time a colleague needs to get in.

Instagram lets several devices sit on the same account’s two-factor set-up, which removes most of that friction. Getting it right is an Operations job as much as a security one: who holds the codes, whose phone is connected, and what happens when someone leaves.

The methods Instagram offers

Instagram gives you a choice of second step:

• Authentication app: an app on your phone generates a fresh code. This is the option marked as recommended.
• Text message: Instagram sends a six-digit code by SMS.
• WhatsApp: codes arrive on WhatsApp, which needs text message security switched on first.
• Security key: offered as a further option.

For a brand account, use an authentication app. It is the method that lets several team members connect their own devices.

How to turn it on in the app

Menu names move around, so follow the labels rather than the exact taps. At the time of writing the route on Android runs like this:

1. Open Instagram and tap your profile picture in the bottom right.
2. Tap the menu icon, the three lines in the top right.
3. Select Accounts Centre.
4. Tap Password and security, then Two-factor authentication.
5. Choose the Instagram account.
6. Pick Authentication app, scan the QR code or copy the setup key into your authenticator app, and enter the code it generates.

On iPhone, the route can run through Settings, then Security, then Two-factor authentication and a Get Started button. The end point is the same screen.

How to turn it on from a browser

On the web, log in at instagram.com, open Accounts Centre, then Password and security, then Two-factor authentication, and choose the account.

If your Instagram and your wider Meta account are linked, you can switch on two-factor authentication for both from the same place. For a brand, that is worth doing in one sitting so nobody is left guessing which account is protected.

The setup key and the backup codes

When you choose an authentication app, Instagram gives you a key, a string of 32 letters and numbers, or a QR code that does the same job. You put that into your authenticator app to link the two.

Instagram also gives you backup codes. These are what help you log in if you lose access to your phone. They are number-only and they are not the same thing as the setup key.

Store both somewhere the team can reach and nobody else can: a shared password manager, not a screenshot in one person’s camera roll. A team that loses its backup codes and its only connected phone at the same time is in for a long recovery.

How to add a second team member’s phone

This is the step most teams miss. You do not need to pass one code around. Instagram allows more than one device on the same account’s two-factor set-up.

Once the first person has switched it on with an authentication app, the next person:

1. Opens the Instagram account on their own phone and goes to Accounts Centre.
2. Taps Password and security, then Two-factor authentication, then Authentication app.
3. Sees the existing device listed and taps Add.
4. Names the new device, then follows the same key and code steps as the first.

If they are not already logged in, they may need the person who first turned on two-factor authentication to share a backup code or approve the login request.

From then on, each person has their own six-digit codes on their own phone.

Name every device after a person

Name each connected device after the person who holds it, not after the phone model. When someone leaves, you can see exactly which device to remove.

A list of three phone models tells you nothing when you are trying to lock out a former freelancer in a hurry.

What to do when someone leaves

Treat it like handing back a key to the office:

• Remove their device from the account’s two-factor list the same day.
• Change the account password.
• Check the backup codes are still where you think they are, and that the leaver never had a private copy.
• Note the change in your access log.

If an account does get locked or disabled anyway, our guide to how Instagram appeals and strikes work covers what happens next.

What good looks like

A well-run brand account has two-factor authentication on an authentication app, at least two named devices connected, and backup codes stored in a shared password manager.

It has a single owner for access, who adds and removes devices and keeps a short log. Nobody shares a login over WhatsApp, and nobody is the only person who can get in.

If that is not how your accounts run today, our workflow and ops consulting work starts with exactly this kind of access map.

How NBK thinks about account security

We treat access as part of the social system, not an IT afterthought. The account is the asset: years of posts, the audience and everything built on them.

Two-factor authentication protects it only if the team around it is organised. One phone and one person is a single point of failure, which is exactly what connecting several devices removes.

Our social media audit checklist is a good way to find the other gaps of this kind.

Next step

If your team is posting regularly but nobody is sure who can get into which account, NBK can help find the constraint in the system.