MuleSoft 2FA: how to set up an authenticator app for Anypoint Platform
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
MuleSoft's Anypoint Platform is where integration teams build, deploy and manage APIs and Mule apps, and it's also the account Anypoint Studio signs in to (MuleSoft). If you sign in with an Anypoint Platform username and password, multi-factor authentication (MFA) isn't optional. MuleSoft requires it for every user, it's on by default for direct sign-ins, and an organization can't switch it off (MuleSoft). Since October 29, 2022, accounts without a method are asked to register one when they sign in.
You can pick from four methods: a third-party authenticator app that makes time-based codes, a built-in authenticator such as Touch ID or Windows Hello, a security key, or Salesforce Authenticator. This guide covers the authenticator app, using Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the MuleSoft steps come from MuleSoft's own documentation, linked below, which we read on October 21, 2026. We haven't tested them on an Anypoint Platform account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
If your company uses single sign-on
None of this applies when you reach Anypoint Platform through your company's SSO. In that case MFA is handled by your identity provider, and your Anypoint user settings show multi-factor authentication as n/a (MuleSoft). Ask your IT team how they set it up.
Turn on 2FA with an authenticator app
If you've never registered a method, Anypoint Platform prompts you at sign-in and you can follow the screens from there. To add an authenticator app later, MuleSoft documents these steps (MuleSoft):
- Sign in to Anypoint Platform.
- In the navigation bar, click the circle with your initials, then select your name.
- Select Configure multi-factor authentication (MFA).
- Next to the third-party authenticator app method, click Add, and follow the instructions on screen.
- Click Done, then Save.
MuleSoft's documentation doesn't describe the setup screen itself, so it doesn't say whether you get a QR code, a typed key, or both. Here's what to do in Novaz with either:
- QR code: tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
- Key: tap +, then Enter key manually, and type it as the Setup key, with something like "Anypoint" under Service. See What is a 2FA setup key?
Type the code Novaz shows wherever the setup asks for it. If you have more than one method, the pencil icon lets you rename each one, which helps if several people's phones or keys end up on the list.
Backup codes
MuleSoft's documentation doesn't mention backup or recovery codes. What it offers instead is more than one method: you can register an authenticator app and, for example, a security key or Touch ID. Novaz's keys stay on your iPhone unless you've made an iCloud backup or a backup file, so a second method is still worth registering.
When Anypoint Platform asks for a code
You confirm with a method each time you sign in with your password. Before you change your account's email address, Anypoint Platform may also ask you to sign in again: with MFA on, that means your password and a code once more than eight hours have passed since you last did both (MuleSoft).
If Anypoint Platform rejects your code
MuleSoft's pages don't cover rejected codes. Most of the time the iPhone's clock is the cause. Go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Do it while you still have the old phone. On the MFA page, add the authenticator app again with the new phone, then remove the old entry: select the bin icon next to it, click Yes, then Done and Save. You can't save with no methods at all (MuleSoft). If you have a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone instead, and the existing entry keeps working. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with another method you registered, if you have one. If not, an Organization Administrator in your company can reset MFA for you: in Access Management, they open Users, pick your account, choose Reset multi-factor authentication from the actions menu, and click Confirm reset MFA. The next time you sign in, you're asked to set up a new method (MuleSoft).
If you're the only Organization Administrator and you've lost every method, MuleSoft says to contact customer support. Its documentation doesn't say what proof support asks for or how long it takes. More in Lost the phone with your authenticator app?
Can you turn it off?
No, not for people. Waiving MFA for user accounts hasn't been allowed since August 1, 2023. Admins can exempt only certain service accounts, such as test automation and RPA systems, and MuleSoft wants those moved to connected apps (MuleSoft).
