GitHub Mobile now supports two-factor authentication
GitHub is adding two-factor authentication (2FA) to its mobile app for iOS and Android. The feature, rolling out this week via the App Store and Play Store, gives users a passwordless approval flow through push notifications instead of typing in a one-time code.
Mobile 2FA is intended as a complementary option alongside existing channels: security keys and WebAuthn, time-based one-time passwords (TOTP), and SMS. It avoids the friction of copying codes from third-party authenticator apps or waiting on text messages, while relying on the same GitHub account infrastructure developers already use daily.
How to enable it
If you already have 2FA turned on and the app installed, simply update GitHub Mobile from the store to start using the new flow. New users can download the app from github.com/mobile and sign in.
For those who haven't yet enabled 2FA, you must first configure it with SMS or a TOTP application through your account security settings. There is no way to begin with Mobile 2FA as your initial method.
Once set up, signing in to GitHub.com from any browser triggers a push notification to your device. You approve or reject the sign-in attempt, and an approval completes the login immediately without entering any extra code.
Security key precedence
If your account already uses a security key for 2FA, GitHub keeps that as the primary method. Security keys offer the strongest protection for account credentials, so the mobile flow will not override that preference.
GitHub says it is continuing to work on account security improvements for both the npm ecosystem and GitHub itself. Additional WhatsApp authentication capabilities and broader 2FA adoption are reportedly in progress. Documentation for securing an account with two-factor authentication is available on GitHub Docs.
