Postmark 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Postmark is the email delivery service developers use to send password resets, receipts and other transactional email. Your login reaches your servers, API tokens and sending history, so it's worth protecting even on a free account. Two-factor authentication (2FA) is available on every plan, but the methods aren't the same everywhere: on the free Developer plan, App authentication (an authenticator app) is the only one you can add. Basic, Pro and Platform plans can also use SMS authentication (Postmark).
2FA is optional for each user unless the account owner turns on a requirement for the whole team (more on that below). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Postmark steps come from Postmark's own support center, linked below, which we read on October 21, 2026. We haven't tested them on a Postmark account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Each user sets up 2FA for their own login. Postmark's support article describes these steps (Postmark):
- Log in to Postmark, select your name in the top right, and choose Profile.
- Scroll to the Security area and select Turn on next to Two-factor authentication.
- Confirm your password.
- Choose Set up for App authentication. On the free Developer plan, it's the only choice offered.
- Add Postmark to Novaz from the setup screen. If it shows a QR code, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Confirm the method, typically by entering the code Novaz shows.
- Download your backup codes and keep them somewhere safe.
Postmark's article lists the steps without showing the app setup screen, so it doesn't say whether there's a QR code, a text key or both, or how many digits its codes have. If you can scan a QR code, do: it carries the code settings to your app. If you only get a key, add it in Novaz with +, then Enter key manually, and put it in Setup key. See What is a 2FA setup key?
Postmark names Google Authenticator, Authy and 1Password as supported apps; other standard authenticator apps, Novaz included, should work the same way.
App or SMS: setting the primary method
On a paid plan, you can add a second method once the first one is set up, so you can have both an app and SMS. To have Postmark ask for the app code first, go to Profile, select Manage next to Two-factor authentication in Security, enter your password, and select Set as primary for App authentication (Postmark).
An SMS number you already confirmed keeps working if your account moves to the free plan, but you can't add a new one there. SMS also isn't sent to some countries, such as Russia and Singapore. For the trade-offs between the two, see Authenticator app vs. SMS.
Backup codes
Postmark gives you backup codes during setup. If you skipped saving them, you can get them later: Profile > Security > Manage next to Two-factor authentication, enter your password, then View codes, where you can download or print them (Postmark).
Postmark is direct about why they matter on the free plan: with only the app as a method, the backup codes are your only other way in. Without a Novaz backup, the keys exist only on your iPhone, so treat those codes as your backup and store them away from the phone. See 2FA backup codes.
When Postmark asks for a code
After you turn on 2FA, Postmark asks for a code each time you log in, right after your username and password. Its article doesn't mention a way to trust a device and skip the code.
Requiring 2FA for your team
An account owner can make 2FA mandatory: select Account in the top header, then Require 2FA on the Account Overview page, and confirm your password. Users without 2FA are asked to set it up the next time they log in. You need 2FA on your own login before you can require it. The owner can also check who has it turned on from Users (Postmark, Postmark).
If Postmark rejects your code
Postmark's article doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?
New phone or lost phone
Postmark's tip for a new phone without the app is to log in with a backup code, or with an SMS code if you set one up (Postmark). Its article doesn't describe how to replace the app method after that, so look under Manage next to Two-factor authentication once you're in. If you restore Novaz from iCloud backup or a backup file, Postmark comes along; otherwise you'll add it again on the new phone. See How to transfer your authenticator app to a new iPhone.
If you can't use your authenticator at all, use a backup code or the SMS method. Without either, Postmark says to contact its customer success team through its contact page. It doesn't say what proof it asks for or how long recovery takes. More in Lost the phone with your authenticator app?
Turning 2FA off
Postmark's support pages don't describe turning 2FA off. If your account owner requires 2FA, you'll be asked to set it up again at your next login anyway.
