Carta 2FA: how to set up an authenticator app

Carta is where many people see their stock options and shares, and where companies and investment firms manage cap tables and funds. You can't skip two-factor authentication (2FA) here: Carta asks you to set it up while you register, and if you later delete your only method, it signs you out and makes you set one up again. You choose between a third-party authenticator app and text messages, and Carta's advice is plain: "Carta always recommends using an authenticator app" (Carta). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Carta steps come from Carta's own help center, linked below, which we read on October 21, 2026. Its articles are built with JavaScript, so we read the article text that each help page's own HTML carries. We haven't tested the steps on a Carta account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Set up the authenticator app when you register

Carta's setup article, last updated October 1, 2026, describes this flow (Carta):

1. When Carta asks you to protect your account with 2FA, choose Continue with authenticator app.
2. Carta shows a QR code. In Novaz, tap +, then Scan QR code, and point the camera at it. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
3. If the code won't scan, use the link under the QR code. Carta then shows a setup key. In Novaz, tap +, then Enter key manually, fill in Service (for example, Carta) and type the key as the Setup key. See What is a 2FA setup key?
4. Type the 6-digit code from Novaz into Carta and click Continue.
5. Save the backup codes Carta offers (more on these below).
6. Carta shows a confirmation and takes you into your account.

Carta's article doesn't say how often its codes change. Scanning the QR code is the safer choice, because the code carries those settings to the app.

Add an authenticator app to an account that uses SMS

If you picked text messages at registration, you can add the app later (Carta):

1. Click your name in the top right and select User Settings.
2. On the Login and security tab, scroll to the two-factor section and click + Add authenticator app.
3. Scan the QR code with Novaz and confirm with a code, as above. Carta emails you when a new 2FA device is added.

Carta merged its old Profile and Security pages into User Settings, so older articles that mention a Security page mean the same place (Carta). You can keep several phone numbers alongside one app-based method.

Keep the backup codes

After setup, Carta gives you a list of backup codes. If you download them, the file is usually named carta-backup-codes.txt on your computer (Carta). They spare you the identity check described below. Keep them even if you back up Novaz: move the file somewhere safe, such as a password manager. The help pages don't say how many codes you get or how to make new ones. See 2FA backup codes.

When Carta asks for a code

Carta emails you when someone enters your correct username and password on a new device. When you type your code at sign-in, you can tick Trust this device for 30 days to skip the prompt on that device for a while (Carta).

If Carta rejects your code

Carta's help doesn't cover rejected authenticator codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when your clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Carta's rule for changing methods is to add the new 2FA device first and delete the old one after (Carta). To delete one, open User Settings, click the three dots next to the device, select Delete, then enter your Carta password and click Delete device. If you delete your only method, Carta signs you out and asks you to set up 2FA again, which is when you'd scan a new QR code with the new phone. Carta doesn't describe swapping one authenticator app for another directly, so do this while you still have the old phone and your backup codes.

With Novaz, there's a simpler route: restore your accounts on the new iPhone from iCloud backup or a backup file, and the codes keep working. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Carta's reset article describes two steps (Carta):

1. Try a backup code. Sign in at login.app.carta.com with your username and password, click Try other options under the code prompt, enter a backup code and click Continue.
2. Verify your identity. Without backup codes, click Verify your identity, pick a reason and click Request two-factor reset. Then choose how to send your documents:
   • Automatic check. Get a link by text message or by scanning a QR code, tap Start Verification, and photograph a government ID and your face. Carta uses an outside company, Socure, for this. You should get an email within minutes, and a successful check resets 2FA right away.
   • Manual check by Carta's team. Click Begin manual upload process, upload a photo of your ID, then a photo of yourself holding that ID and a note with today's date, and click Submit request. This can take up to one business day.

The name on your ID has to match the name on your Carta account. Carta Support is available by phone at +1 (650) 669-8381, Monday to Friday, 6 a.m. to 5 p.m. Pacific time (Carta). More in Lost the phone with your authenticator app?

Official Carta help

• How to set up two-factor authentication (2FA)
• How to reset your two-factor authentication (2FA)
• How to troubleshoot issues logging into Carta
• How to manage your security and account settings
• Introducing the new User Settings page