Flexera Software Vulnerability Research 2FA: how to set up an authenticator app

Flexera's two-factor authentication (2FA) setup belongs to Software Vulnerability Research, the Flexera product security teams use for vulnerability intelligence, assessment and patching (Flexera). Here 2FA isn't an optional setting you go looking for. Flexera's help library calls it mandatory: the first time you sign in with a new account, you have to set it up before you get in (Flexera).

You get two choices, an authenticator app (Flexera calls it Token) or text messages (SMS). Flexera recommends the token method and makes it the default. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app that makes time-based codes works the same way.

How we checked this guide: the Flexera steps come from Flexera's own Software Vulnerability Research help library, linked below, which we read on October 21, 2026. docs.flexera.com blocks automated access, so we read the pages in copies saved by the Internet Archive (web.archive.org), the newest from March 2026. Since April 2026 those addresses send you to Flexera's redesigned documentation site, which may word things differently. We haven't tested the steps on a Flexera account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Which sign-in this covers

Flexera's help pages describe this 2FA for Software Vulnerability Research accounts. They don't describe an authenticator-app option for other Flexera sign-ins, such as Flexera One.

Set up 2FA with an authenticator app

Flexera's help describes the token setup as part of your first sign-in (Flexera, Flexera):

1. Sign in to Software Vulnerability Research with your username and password.
2. On Choose a two-factor authentication method, select Token, then Next.
3. Flexera shows a QR code and a Verification Code field.
4. In Novaz, tap +, then Scan QR code, and point the camera at the QR code on your computer screen. If the page is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Type the code Novaz shows into Verification Code on the sign-in page.
6. Click Save to finish signing in.

Flexera's instructions name Google Authenticator and Duo by Cisco as examples, but the method is standard time-based codes (TOTP), so other authenticator apps work too (Flexera).

The help doesn't mention a text key you could type instead of scanning, or how many digits the codes have. Plan to scan the QR code. That also lets Novaz pick up the code settings from the code itself.

Token or SMS

Flexera describes text messages as a fallback for people without an authenticator app, and calls SMS "a less secure and a less reliable method" (Flexera). With SMS you enter your phone number in international format, starting with +, and click Send an SMS to get a code by text. If you can install an app, choose Token. For the general trade-off, see authenticator app vs. SMS.

No backup codes

Flexera's help doesn't mention backup or recovery codes for Software Vulnerability Research, and it doesn't describe a way to switch from SMS to token (or back) after setup, or to move the token to a new phone yourself. The only route it documents for a lost or compromised phone is a reset, covered below. Before you change phones, contact whoever can reset your 2FA so you're not locked out.

If you turn on iCloud backup or export a backup file in Novaz, you can restore Flexera on a new iPhone and the codes keep working. Without a Novaz backup, a new phone means adding Flexera again after the reset. See How to transfer your authenticator app to a new iPhone.

If Flexera rejects your code

Flexera's help doesn't cover rejected codes. Time-based codes depend on your phone's clock, so check it first: on iPhone, Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Also make sure you're reading the Flexera entry in Novaz and typing the code before it changes. More causes are in Authenticator code not working?

If you lose your authenticator

Who can reset your 2FA depends on your account type (Flexera):

• User accounts: your organization's main Administrator can reset it in Software Vulnerability Research. In the Settings module they go to User Management > Users, expand your row, and click Reset two factor login. Flexera suggests they confirm it's really you before doing it.
• The main Administrator account: Flexera Support resets it after checking the account holder's identity. The help doesn't say what proof Support asks for or how long it takes.

After a reset, expect to set up 2FA again at your next sign-in, the same way as the first time. More on what to do next in Lost the phone with your authenticator app?

Official Flexera help

These are the Software Vulnerability Research help pages we read, in archived copies. The addresses now redirect to Flexera's current documentation site.

• Configure Two-Factor Authentication (2FA)
• Token-Based Two-Factor Authentication
• SMS-Based Two-Factor Authentication
• Two-Factor Authentication Recovery
• Introduction (Software Vulnerability Research Help Library)