Mural 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Mural is the online whiteboard many teams use for workshops, planning sessions and retrospectives. Its two-factor authentication (2FA, which Mural also calls MFA) is a checkbox in your account settings, and it pairs with an authenticator app on your phone. Two things decide whether you can turn it on yourself. If you sign in to Mural with single sign-on (SSO), you can't. And if your company's Enterprise plan already requires 2FA, you'll be asked to set it up at sign-in instead (Mural). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Mural steps come from Mural's own help center, linked below, which we read on October 21, 2026. Mural's current help center only loads its articles with JavaScript, so we read the same articles in archived copies on web.archive.org, saved from March to June 2023. Mural's sitemap shows the individual 2FA article was last changed on August 17, 2023. We haven't tested the steps on a Mural account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Mural's article lists Google Authenticator, Microsoft Authenticator and Twilio Authy as examples. It uses the standard QR code and setup key, so other authenticator apps such as Novaz can read them too (Mural).
- Sign in to Mural and click your avatar. The individual article puts it in the top right corner; the Enterprise article, in the bottom left. Look in both places.
- Click More account options.
- Under Security, select the Two-factor authentication checkbox.
- Type your password and click Next. Mural opens a window with a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If Mural is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan, the same window shows a secret key. In Novaz, tap +, then Enter key manually. Type "Mural" under Service, your email under Account, and the key as the Setup key. See What is a 2FA setup key?
- Back in Mural, click Next, type the 6-digit code from Novaz, and click Next again.
Mural's help doesn't say how often its codes change. Scanning the QR code is the safer choice, because the code carries those settings. A key typed by hand gets 6-digit codes every 30 seconds.
Save the recovery codes Mural gives you
When setup finishes, Mural shows several recovery codes. You can copy them or download them as a .txt file. Each code works once (Mural). Without a Novaz backup, its keys exist only on your iPhone, and even with one, these codes get you in if the backup is out of date. Keep them in a password manager or on paper, away from the phone. See 2FA backup codes.
If you skipped saving them, Mural's FAQ says you can find them again: click your avatar, then Profile, then View recovery codes under Security, and enter your password. When you've used them all, Mural emails you a fresh set (Mural, Mural).
Signing in afterwards
At app.mural.co, enter your email and password, then the 6-digit code from Novaz, and click Verify (Mural). Mural says 2FA works in all versions of Mural, including its desktop and mobile apps (Mural). A company requirement, though, only applies to the web app (Mural).
When your company requires it
Enterprise admins can require 2FA for members, guests or both, under Two-factor authentication on the General page of the Company dashboard. Members who sign in with SAML SSO are exempt. If your company requires it, you'll see a Set Up 2FA prompt the next time you sign in (Mural, Mural). If the checkbox in your settings is ticked and won't clear, your company has turned 2FA on for you (Mural).
If Mural rejects your code
Mural's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. More causes in Authenticator code not working?
Changing phones
Mural's help doesn't describe moving 2FA to a new phone. With Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone and keep the same codes. Without one, set Mural up again on the new phone while you can still sign in. Keep your recovery codes handy in case you need one. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with a recovery code. Without one, contact Mural Support, which can turn off 2FA on your account by hand. The admin FAQ says Support first checks who you are and sends you an email to confirm (Mural). Mural doesn't say how long this takes. Once 2FA is off, you can set it up again. More in Lost the phone with your authenticator app?
Mural's help doesn't give separate steps for turning 2FA off. Its FAQ implies you clear the same checkbox under Security, which you can't do when your company requires 2FA (Mural).
