If an account has two-factor authentication turned on, Instagram asks for a six-digit code every time it logs in. Left unconfigured, that prompt stops the login, and the account sits idle until somebody types a code by hand.
Onimator can answer that prompt for you. This guide covers both ways to set it up and which one to choose.
This is for Instagram accounts. The 2FA panel handles Instagram's verification prompt specifically. On the other platforms Onimator supports, you log into the app on the device yourself and the bot automates whatever account is already signed in.
Overview
Should you even enable 2FA on an automated account? Yes, and it is worth saying plainly, because the instinct when automating is to remove anything that adds friction.
An account without 2FA is easier for you to run and easier for everyone else to take. Accounts with reach get targeted, and a stolen account is a worse outcome than a login prompt. Instagram also treats 2FA as a positive signal on the account itself.
The friction is a one-time setup cost. After that the bot handles it.
The Two Methods
| Setup code | Backup codes | |
|---|---|---|
| What it is | A TOTP seed, the same string an authenticator app uses | A list of one-time codes Instagram generates |
| Runs out? | No, it generates codes indefinitely | Yes, each code is consumed once |
| Maintenance | None | Add more when they run low |
| Best for | Everything | A fallback, or accounts where you cannot get the seed |
Use the setup code. It is the only option that does not need topping up, and it is what the field is designed around. Backup codes exist for the cases where the seed is unavailable.
You can configure both. The bot uses the setup code when it has one.
Getting the Setup Code from Instagram
The setup code is the TOTP seed, and Instagram shows it during 2FA setup even though most people scan past it.
- In the Instagram app, go to Settings → Accounts Centre → Password and security → Two-factor authentication
- Select the account and choose Authentication app
- Instagram offers a QR code for your authenticator app. Below it there is a link along the lines of "Can't scan the barcode?" or "Use this code instead"
- Tap it. The string it shows is your setup code
It looks like a run of letters and numbers in blocks, for example abcd efgh ijkl mnop. Copy the whole thing.
Save it somewhere before you finish setup. Instagram will not show that string again once 2FA is enabled. If you skip past it you will have to turn 2FA off and back on to get a new one.
Add it to your own authenticator app as well. The seed works in Onimator and in Google Authenticator or 1Password at the same time. That gives you a way to log in manually when you need to, without touching the Onimator config.
Getting Backup Codes
If you would rather not store the seed, or you inherited an account whose seed you never captured, backup codes work instead.
In the Instagram app go to Settings → Accounts Centre → Password and security → Two-factor authentication → Additional methods → Backup codes. Instagram shows a set of one-time codes.
Each code works exactly once. When the bot uses one it is spent, and the account needs more before the list is empty.
Configuring It in Onimator
- Open the account's settings, the gear icon on the account's row
- Find the Two-Factor Authentication section
- Tick Enable 2FA handling
- Paste your seed into Setup code
- If you are using backup codes, click Add Backup Codes and paste them in. They appear in the table with a status against each one, so you can see what has been used
- Save
The field's own hint tells you the rule: leave Setup code blank if you are relying on backup codes only. Filling in one or both is fine. Filling in neither, while 2FA is enabled on the Instagram account, means the login will still stall.
Setting It Up During Bulk Import
If you are onboarding many accounts at once, you do not need to open each one.
The account import CSV carries the seed in its final column, 2fa_setup_code:
deviceid,username,password,appid,start_hour,end_hour,2fa_setup_code
Leave the cell empty for accounts without 2FA. Full column reference is in How to Bulk Import Accounts via CSV.
That file now contains passwords and 2FA seeds together. Delete or encrypt it once the import succeeds, and never attach it to a support ticket. If support needs to see your import format, send a version with the credentials stripped out.
Safety & Best Practice
The setup code deserves the same handling as the password, because functionally it is one.
Anyone holding that seed can generate valid codes for the account indefinitely. Unlike a password, there is no prompt telling you it has been used elsewhere, and rotating it means disabling and re-enabling 2FA on the account.
Do not paste seeds into chat, email or support tickets. If you have already, turn 2FA off on that account and set it up again to invalidate the old seed.
Redact them from screenshots. The Setup code field shows the string in plain text, so it lands in any screenshot of that panel.
Common Issues
The account still stops at the verification screen. Check that Enable 2FA handling is actually ticked. The seed being present does not switch the feature on by itself.
The seed is rejected or codes do not work. Paste the string exactly as Instagram showed it. Spaces between blocks are fine, but a missing or extra character makes every generated code wrong. If in doubt, add the same seed to a phone authenticator app: if that app's codes are rejected by Instagram too, the seed is wrong rather than the configuration.
It worked and then stopped. If 2FA was reset on the Instagram account, or the account was recovered through a different method, the old seed no longer matches. Capture the new one.
Backup codes stopped working. They are one-time use. Check the Status column in the table and add a fresh set.
Logins are failing but not on the 2FA screen. Then this is not a 2FA problem. Check the proxy, the password, and whether the account is facing a checkpoint rather than a code prompt. Setting up a proxy covers the network side.
A note on auto re-login. If you use the automatic logout and login recovery cycle in Global Settings, test it on one non-critical 2FA account before enabling it across the fleet, and confirm the cycle completes rather than stalling at the code prompt. Settings are covered in the Global Settings manual.
Tutorials & Support
- How to Add Your First Account
- How to Bulk Import Accounts via CSV
- How to Warm Up a New Instagram Account
- Two-Factor Authentication in the glossary