Formstack 2FA: how to set up an authenticator app

Your Formstack account signs you in to Formstack Forms, Documents and Sign, and to the Admin panel where your organization manages users. On most accounts, two-factor authentication (2FA) isn't optional: Formstack has required it for new accounts since September 24, 2024, and has been turning it on for existing paid accounts in phases, with 30 days' notice (Formstack, Formstack). Codes come from an authenticator app or by text message, and Formstack itself calls SMS handier but weaker (Formstack). This guide uses Authenticator App - Novaz on iPhone; any other authenticator app works the same way.

How we checked this guide: the Formstack steps come from Formstack's own help center and blog, linked below, including the screenshots in its articles, which we read on October 20, 2026. We haven't tested them on a Formstack account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

These steps follow Formstack's setup article (Formstack):

1. Go to your profile page. Org Admins pick Administration in the product switcher (or go to admin.formstack.com) and open their profile. Standard users click their name in the app header and choose Update Your Profile.
2. On Your Profile, scroll down to Profile security and turn on the Two-factor authentication toggle.
3. A Two-factor authentication window opens with a QR code. In Novaz, tap +, then Scan QR code, and aim the camera at it. If Formstack is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
4. If it won't scan, click Can't scan it? to get what Formstack calls a shared key. In Novaz, tap +, then Enter key manually, and enter it as the Setup key. See What is a 2FA setup key?
5. Type the 6-digit code from Novaz and click Verify code.
6. Save the backup codes Formstack offers right after (more below).

Formstack's help shows 6-digit codes but never says how long each lasts. Scan when you can: the QR code carries Formstack's exact settings, while a typed key always gets 6 digits every 30 seconds.

The article's screenshots date from April 2024, and the June 2024 release notes list a redesigned 2FA window (Formstack), so your screen may not match word for word. The Authenticate via SMS link in the same window switches to text codes; see authenticator app vs SMS.

Your backup codes

Once setup is done, Formstack lets you copy or download a set of backup codes, and it strongly recommends doing so (Formstack). Each one can stand in for an app code (Formstack). With Novaz they're your way back in if the phone is gone and you have no iCloud backup or backup file of Novaz, since without one its keys exist only on that iPhone. Formstack also says to keep them off your phone, so try a password manager or a printout.

Skipped them? On your profile page, the backup verification codes link in the Two-factor authentication row lets you view, download or regenerate them (one article calls it a View Backup Verification Codes button). The setup SMS link next to it adds a backup phone number (Formstack). More in 2FA backup codes.

When Formstack asks for a code

Every time you log in, after your password (Formstack). The help pages we read mention no way to remember a device. Formstack's emailed code is a different thing: it goes only to users without 2FA who haven't logged in for 90 days (Formstack).

For admins: requiring 2FA and SSO

Platform Admins can force 2FA on every user: in Security Settings, turn on Enable Two-Factor Authentication (2FA) for all users, confirm with Yes, Force Login Via 2FA, and click Save Changes. The toggle may be greyed out (Formstack). If your SSO provider already enforces 2FA, an admin can turn on Opt out of Formstack's 2FA for these SSO providers so people aren't asked twice (Formstack).

If Formstack rejects your code

Formstack's troubleshooting article covers backup codes and resets, but not codes that don't work. The usual culprit is the iPhone's clock: go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More fixes: Authenticator code not working?

Moving to a new phone

Formstack's way is to open your profile page, click the pencil icon (shown as Edit in newer screenshots) next to Two-factor authentication, and run the setup again (Formstack). Do this before you give up the old phone, unless you restore your accounts on the new iPhone from a Novaz iCloud backup or backup file, which keeps the same codes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Formstack suggests three steps, in this order (Formstack):

1. Use a backup code in place of the app code.
2. Ask an admin in your organization. Org Admins can reset anyone's 2FA. Standard users with User Management permission can reset it for other Standard users. They click Reset next to Two-factor authentication on your profile in the Admin panel, or pick Reset 2FA from your row's actions menu on the Users page. You then get an email, and 2FA stays off until you set it up again (at your next login, if your organization requires it). Nobody can reset their own 2FA this way (Formstack).
3. If you're the only admin and never saved your backup codes, contact Formstack Support through its service request form. Expect to confirm your identity with details such as billing information. Formstack doesn't say how long this takes.

More in Lost the phone with your authenticator app?

Turning 2FA off

Formstack says every organization user can turn 2FA on and off on their own profile page (Formstack). It doesn't give the steps, or say whether that still works when your account or organization requires 2FA. If you do turn it off, open Formstack in Novaz and tap Remove account.

Official Formstack help

• Two Factor Authentication
• Troubleshooting Two-factor Authentication Issues
• Resetting Two-factor Authentication(2FA)
• Account Security Settings
• Why am I being asked for a code to log in to my Formstack account?
• Update Your Profile
• Formstack Single Sign-On Overview
• June 2024 Formstack Release Notes
• Securing Your Account and Data with Two-Factor Authentication (Formstack blog)