Firmex VDR 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Firmex VDR is a virtual data room that companies use to share confidential deal documents with outside parties. If you've been invited to a Firmex data room, you won't find a two-factor switch for yourself. A Firmex administrator decides whether you use it and which method you get: an authenticator app, an email code, or a text message. Individual users can't opt in or out (Firmex).
Firmex calls the feature two-factor authentication (TFA) in its help, but the product itself says Two-Step Verification. This guide covers what happens once an administrator picks the authenticator app for you. We use Authenticator App - Novaz on iPhone in the steps. Any authenticator app works the same way.
How we checked this guide: the Firmex steps come from Firmex's own help center, linked below, which we read on October 21, 2026. Firmex's help pages refuse automated requests, so we read the same articles through the help center's public article feed on support.firmex.com. We haven't tested them on a Firmex account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
- Your company uses single sign-on (SSO): two-factor is then handled by your identity provider, not by Firmex. Ask your IT team (Firmex).
- Use the website. You can only link an authenticator app on the Firmex website, not in the desktop or mobile apps. Firmex also says its iOS app doesn't support signing in with an authenticator app, so if you rely on the iPhone app, ask your site administrator for another method (Firmex).
- You belong to several Firmex sites: two-factor is set per site, not per project. If any of your sites uses the authenticator app, you'll always sign in with the app only, even on the other sites (Firmex).
Link an authenticator app at your next sign-in
There's no setup page to look for. Once an administrator has chosen the authenticator app for you, Firmex asks you to link it the next time you sign in (Firmex):
- Sign in on the Firmex website, either at login.firmex.com or at your company's own address, such as companyname.firmex.com (Firmex).
- After your password, Firmex opens a window asking you to set up your authenticator app. It shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Firmex also shows a 32-character code you can type instead. In Novaz, tap +, then Enter key manually, enter "Firmex" as the Service and the code as the Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz into the Firmex website.
Firmex's help says the code changes every minute, while a key typed into Novaz always makes codes that change every 30 seconds. Scanning the QR code avoids any mismatch, because the QR code tells Novaz how the codes are made. If a typed key gives codes Firmex won't accept, remove that account in Novaz and scan instead.
When Firmex asks for a code
Firmex asks for the code when you sign in, not when you open a project. The sign-in page offers a trust me on this computer/device checkbox. If you use it, you still need a fresh code on another computer, in another browser, after you clear your cookies, or after an administrator resets your setting. A site administrator can also require a code on every sign-in, which removes that checkbox (Firmex).
No backup codes
Firmex's help doesn't mention backup or recovery codes for the authenticator method. Your fallback is your site administrator, so know who that is before you need them.
If Firmex rejects your code
Firmex's help doesn't give its own advice for rejected codes. Then check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. If you typed the key by hand, try scanning the QR code instead, as above. More causes are in Authenticator code not working?
New phone or lost phone
Both go through your administrator. Firmex says that after a lost phone, a new phone or a factory reset, a Firmex Site Administrator opens your Two-Step Verification settings and clicks Reset Authenticator App. That clears your link, and Firmex asks you to set up the app again at your next sign-in (Firmex).
The administrator can also turn two-step verification off for you from the Site Users screen. You can call Firmex Client Services too, but they act only with the approval of a Site Administrator or an authorized contact at your company. Firmex doesn't say how long this takes.
If you use Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and skip the reset. Without one, a new iPhone means asking for that reset. Keep the old phone until you've signed in with the new one. See How to transfer your authenticator app to a new iPhone and Lost the phone with your authenticator app?
For site administrators
To choose the method for one user, click your company logo in the top-left corner, open the Site Users tab, and click the Two-Step Verification icon to the left of the user's name. Then pick Enable Authenticator App, Enable SMS, Enable Email or Disable. For several users at once, tick their checkboxes, click Manage Users, and choose Manage Two Step Verification (Firmex).
To opt in every new user, Firmex points to Make mandatory for all New users under Site Settings, on the Options tab. The help pages name these screens slightly differently, so labels may vary (Firmex).
