Skip to content
Novaz AuthenticatorGET

Box 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Who decides
  2. Turn on 2FA with an authenticator app
  3. Backup codes
  4. How often Box asks
  5. If Box rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official Box help

Box is a cloud storage service that many companies use, and it has personal accounts too. Its two-factor authentication (2FA) is called 2-Step Verification, and you pick one second step: an authenticator app, a security key, a text message or an email code. Box recommends the app or a key over SMS (Box). Two things are unusual: Box asks for a phone number after you add the app, and your organization may decide for you whether and how you use 2FA. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Box steps come from Box's own support articles, linked below, which we read on October 20, 2026. We haven't tested them on a Box account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Who decides

  • Your company signs you in with SSO: the 2-Step Verification section doesn't appear at all (Box).
  • Your Box admin requires it: admins can make it mandatory and limit the allowed methods (Box). They can even require one particular authenticator app; if yours does, use that app.
  • Another company shares files with you: it can require 2FA from outside collaborators. Its files wait under ACTION REQUIRED on your Files page, where Set Up opens Set up 2-Step Verification (Box). By default, outsiders must use an app or a security key (Box).
  • Personal account: it's up to you.

Turn on 2FA with an authenticator app

Use a web browser: when an admin requires 2FA, Box says you must set it up in the web app before the mobile app works (Box). These steps follow Box's setup article, last edited in June 2026 (Box):

  1. Click your account icon at the top right, choose Account Settings, and stay on the Account tab.
  2. In the 2-Step Verification section, click Set Up.
  3. Select Authentication App and click Next.
  4. Box shows a QR code. In Novaz, tap +, then Scan QR code. If the code is on the iPhone you're using, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  5. Under the QR code is a secret key you can type instead: in Novaz, tap +, then Enter key manually, and put it in Setup key. Box doesn't state its code length or interval, so scanning is safer. See What is a 2FA setup key?
  6. Type the code from Novaz and click Submit.
  7. Enter a phone number and click Submit. Box support uses it to confirm your identity if you can't sign in with the app. It has been mandatory since 2021 (Box).
  8. Copy the backup codes, save them somewhere only you can open, and click Complete.

Box allows one method at a time. Another Box article shows a checkbox instead of Set Up (Box), so labels may differ.

Backup codes

Box gives backup codes when you set up the app, SMS or a security key, but doesn't mention them for email codes (Box). Each code works only once (Box). To use one, click Use account backup code instead on the verification screen, type it, and click Submit. Box says you can make new codes as needed (Box), but its setup article doesn't say where.

If you lose the phone without a Novaz backup, these codes are your way back in; keep them off the phone. See 2FA backup codes.

How often Box asks

Box remembers a browser once you pass the check, until you clear its cache and cookies (Box). On company accounts, the admin sets the interval: every login, or a period from 2 hours to 90 days, with 30 days as the default (Box). External collaborators are asked again after 30 days at most (Box).

If Box rejects your code

Box's help doesn't address a wrong authenticator code. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If Box shows a page-not-found error after the code step, it suggests a private window, clearing cache and cookies, turning off privacy extensions, or another browser (Box). More causes are in Authenticator code not working?

One exception: Box FTP doesn't work with authenticator-app verification. Box says to switch to SMS if you need FTP (Box).

Changing phones

Box doesn't describe a phone switch. Using what it does document, remove the authenticator app while the old phone still works (below), then set it up again on the new one. If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Start with a backup code. Without one, Box points you to your primary admin, who can turn 2FA off for your account; on Business Plus and Enterprise, admins can do it with instant login in the Admin Console (Box). Admins can also exempt you, so you sign in with only your password (Box).

On Personal, Starter and Business accounts, Box says to contact Box Product Support. Support uses the phone number you gave at setup to check your identity. Box doesn't say what else it asks for or how long it takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Open Account Settings from your account icon, scroll to the Authentication section on the Account tab, click Remove next to the method, then Remove again to confirm (Box). If your admin requires 2FA, you'll have to add a method again the next time you sign in. If Box replies "Unable to remove 2-step verification" (Box), try the browser fixes above. Then open Box in Novaz and tap Remove account.

Official Box help

More guides: Cloud storage and backup