Headway 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Headway connects mental health providers with clients who pay through insurance. Providers and clients have different accounts, with different 2FA rules. For providers, two-factor authentication is mandatory. For clients, it's optional, though Headway strongly recommends it (Headway).
You can enroll several methods: an authenticator app, a text or call to a US (+1) number, fingerprint or face sign-in, and a security key. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the Headway steps come from Headway's own help center, linked below, which we read on October 21, 2026. The help center pages block automated visitors and had no archived copy, so we read the articles through the help center's public article feed on help.headway.co, which returns the same article text. We haven't tested the steps on a Headway account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
The starting point depends on which side of Headway you're on (Headway).
Clients:
- Sign in at headway.co and open the Settings page (care.headway.co/settings).
- Click Enroll next to the authenticator app.
- Follow the prompts on screen.
Providers:
- Sign in to the provider portal at sigmund.headway.co.
- Go to Settings and open the Login tab.
- Click Enroll next to the authenticator app.
- Follow the prompts on screen.
Headway's article doesn't list the screens that come next. It links video walkthroughs instead. Authenticator setup usually shows a QR code and then asks for a code. In Novaz:
- Tap +, then Scan QR code, and point the camera at the code on your computer screen. If Headway is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- If Headway shows a text key, you can type it instead: tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. The help article doesn't say whether a key is shown or what Headway calls it. See What is a 2FA setup key?
- Type the current 6-digit code from Novaz back into Headway.
Headway says its authenticator codes are 6 digits and change every 30 seconds, which matches what Novaz uses for a key typed by hand.
Save the recovery code
Headway gives you a single recovery code, not a list. It's created once your first method is added, and it works one time only. After you use it, Headway gives you a new one to save (Headway). Print it or keep it in a secure note, away from your phone.
If the phone is lost and you have no Novaz backup (iCloud backup or a backup file), that recovery code is your way back. Headway also suggests enrolling at least two methods. More on this in 2FA backup codes.
When Headway asks for a code
Headway asks for the second step when you sign in. Its help article doesn't say whether it asks every time or remembers trusted devices.
Phone codes only reach US numbers, so have the authenticator app ready before you travel abroad. Fingerprint or face sign-in only appears on the device where you enrolled it; elsewhere, choose Authenticator app or Phone.
If Headway rejects your code
Headway's troubleshooting covers SMS codes and biometrics, not authenticator codes. If a code from Novaz is refused, check your iPhone's clock first: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
Getting a new iPhone
Headway's advice is to have a synced authenticator or your recovery code ready before you switch phones. Novaz's iCloud backup (PRO) or a backup file can do that job: restore your accounts on the new iPhone and Headway keeps working. Without one, plan to set Headway up again on the new phone. While you can still sign in, clients can use Reset 2FA (below) and enroll the new phone. See How to transfer your authenticator app to a new iPhone.
Resetting 2FA or losing your authenticator
The two account types reset differently (Headway):
- Clients: open the Account page (care.headway.co/account), scroll to Login, and select Reset 2FA. Headway asks you to sign in again, then you set up 2FA from scratch.
- Providers: if you lose the phone or app, contact Headway support. Once support grants an exemption, you have one week to sign in, go to Settings > Login, and click Reset to change your methods.
If you can't use any method, enter your recovery code in the verification field. Without it, contact Headway support, which will verify your identity before restoring access. Headway doesn't say what proof it asks for or how long this takes.
If you can't sign in, use the contact form at headway.co/contact and pick I can't access my account. Headway has no phone support line (Headway). See also Lost the phone with your authenticator app?
A separate code for prescribing controlled substances
Prescribing controlled substances through Headway's e-Prescribe (powered by DrFirst) needs its own token in Symantec's VIP Access app, on a different device from the one you prescribe on (Headway). Novaz can't replace VIP Access there.
