OpenAI's current MFA instructions, checked October 23, 2026, say the available methods depend on the account, device, country, and account tier. Follow the choices actually displayed in your account rather than an older screenshot.
Finish enrollment rather than stopping at the first screen
If you choose an authenticator app, setup can require scanning a QR code and entering the app's one-time code. Other available methods have their own confirmation steps. Complete those steps and verify that the method is listed in your security settings.
Keep setup material private. You do not need to paste a QR code, one-time code, or recovery credential into a chat to get help understanding the procedure. A description such as “The code was rejected” and the name of the method is enough to start a support question.
Before relying on a single phone, check whether your account offers another verification method you can configure and still access if that phone is unavailable. A second method is useful only if you can actually reach it. Two methods that both depend on the same lost device may leave you with the same access problem.
Separate the sign-in check from session management
Consider this fictional setup note:
I enabled an authenticator on my phone. My home laptop is still signed in, and a shared training-room computer may also have an old session.
MFA setup does not settle which of those sessions should remain active. Review them separately. OpenAI's account-security guide explains the security-history and active-session controls. If you use Log out of all devices, the MFA documentation says it can take up to 30 minutes to complete.
For the training-room computer, checking that the authenticator is enabled is therefore insufficient. The session-management action addresses an already signed-in device; the added factor protects later sign-ins. Keep those two outcomes separate when writing your own setup notes.
If the verification device becomes unavailable
At sign-in, use another configured method if you still have one. If none is accessible, the current documented route is OpenAI Support and account verification. OpenAI describes a one-time email recovery login after successful verification; email is not a normal ongoing MFA method. Do not assume that any email address or a new account will bypass the existing account's verification.
Avoid writing down a recovery route from memory and testing it only after losing the device. Review the current instructions while you still have access, especially if your account uses additional account-security features.
Record what you set up without recording secrets
A useful personal note can be short:
Account sign-in method: [the method I use]
MFA method enabled: [method name, no secret or code]
Backup method checked: [method name or still to configure]
Session review completed: [date]
Official recovery instructions: [link]
Keep it with your own account-management records. If you also want a copy of your conversations, that is a separate data-export task; an export does not provide a way around a sign-in challenge. Finish by confirming your verification method and the backup you intend to use.