Skip to content
Novaz AuthenticatorGET

ActiveCampaign 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Who controls the setting
  2. Turn on 2FA with an authenticator app
  3. Where MFA applies
  4. Your recovery codes
  5. If ActiveCampaign rejects your code
  6. Changing phones or switching to SMS
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official ActiveCampaign help

Your ActiveCampaign login guards your contact lists, campaigns and automations. ActiveCampaign calls its two-factor setup multi-factor authentication (MFA). In a web browser it's optional, though recommended. The ActiveCampaign Mobile app is different: it requires MFA, and if you haven't set it up, the app prompts you to do so when you sign in (ActiveCampaign).

You can get codes from an authenticator app or by text message. Text messages are only available on paid accounts. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the ActiveCampaign steps come from ActiveCampaign's own help center, linked below, which we read on October 21, 2026, through the help center's public article feed. We haven't tested them on an ActiveCampaign account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Who controls the setting

On a shared account, the switch isn't always yours (ActiveCampaign):

  • Any user can turn MFA on or off for their own login.
  • Users in the Admin group can require it for one user (under Settings > Users and Groups) or for everyone (the Enable for the entire account toggle). An admin has to set up MFA for their own login before turning it on for the whole account.
  • Once an admin enforces MFA, users can no longer change their own MFA settings.

If an admin has required it for you, the setup appears right after you enter your email address and password, and you scan the QR code there (ActiveCampaign).

Turn on 2FA with an authenticator app

For your own login, ActiveCampaign describes these steps (ActiveCampaign):

  1. Click Settings > Security.
  2. Turn on the Set up for myself toggle.
  3. In the window that opens, choose Authentication App, then click Continue.
  4. ActiveCampaign shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If you're on the same iPhone, take a screenshot, tap +, then Choose a photo. See how to scan a QR code on the same iPhone.
  5. Type the six-digit code from Novaz into the field and click Verify.
  6. Copy the recovery codes ActiveCampaign shows, store them safely, and click Done.
  7. Log out and log back in. ActiveCampaign says MFA only takes effect after that.

ActiveCampaign's help mentions only the QR code, not a key to type by hand, so plan to scan. One older page calls the option App, so the wording may vary.

The help names four authenticator apps as examples and warns that a plain QR scanner won't work: "QR Scanner apps do not generate verification codes" (ActiveCampaign).

Where MFA applies

MFA covers the desktop version plus the ActiveCampaign mobile app, the Conversations mobile app, the Chrome Extension and the Outlook Add-In. ActiveCampaign asks for a verification code every time you log in (ActiveCampaign). Its help doesn't describe a "remember this device" option.

Your recovery codes

Recovery codes get you in when your phone is lost, stolen or damaged. Each works once. At sign-in, click Use Recovery Code below the Verify button, type one, and click Verify (ActiveCampaign).

If you run low or think someone has seen them, go to Settings > Security, click Reset Recovery Codes, enter your password and click Submit. You get a fresh list.

If that iPhone goes missing and you have no Novaz backup, these codes are your fallback. Keep them in a password manager or on paper. More in 2FA backup codes.

If ActiveCampaign rejects your code

ActiveCampaign's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. If you've turned MFA off and on again, the old entry in your app is no longer valid; ActiveCampaign says you have to scan the new QR code. Other causes are in Authenticator code not working?

Changing phones or switching to SMS

To change the method or the device, you turn MFA off and set it up again (ActiveCampaign):

  1. Go to Settings > Security and turn the MFA toggle off.
  2. Enter your password and click Disable.
  3. Turn the toggle back on, choose the app option, and scan the new QR code with your new phone.

Do it before you wipe the old phone, because you need a code from it to sign in. If an admin enforces MFA for you, you can't change these settings yourself, so ask your admin. With a Novaz iCloud backup or backup file, a new iPhone doesn't need this: restore your accounts there and the codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Sign in with a recovery code, then set up MFA again on your new phone. Without recovery codes, the route depends on your role (ActiveCampaign):

  • Regular users ask their account admin, who can reset the codes for them.
  • Admins who are locked out contact ActiveCampaign's Customer Experience Team through the contact page.

ActiveCampaign's help doesn't say what proof the team asks for or how long it takes. See also Lost the phone with your authenticator app?

Turning 2FA off

For your own login, go to Settings > Security, switch Set up for myself to off, and enter your password. Admins turn it off for everyone with Enable for the entire account, or for one user under Settings > Users and Groups > Edit > Multi-Factor Authentication (ActiveCampaign). The mobile app still needs MFA. In Novaz, open the ActiveCampaign entry and tap Remove account.

Official ActiveCampaign help

More guides: Marketing and sales