TherapyNotes 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
TherapyNotes is the practice management and records system many therapists and group practices use for notes, scheduling and billing. Its two-factor authentication (2FA) adds a code from an authenticator app to your practice code, username and password. TherapyNotes calls that code a "token" (TherapyNotes).
Two things set it apart. You don't type a code at every sign-in, because TherapyNotes remembers each browser for 30 days. And your practice controls a lot of it: a Practice Administrator can make 2FA mandatory for everyone and can remove it from your account if you lose your phone (TherapyNotes).
The steps below use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the TherapyNotes steps come from TherapyNotes' own help center, linked below, which we read on October 21, 2026. We haven't tested them on a TherapyNotes account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
Any user role can do this for their own account (TherapyNotes):
- Sign in to TherapyNotes on the web and click Profile.
- Find the Security & Activity section and click Enroll in Two-Factor Authentication.
- Read the overview and click Next. TherapyNotes shows a QR code and a text token you can type instead.
- In Novaz, tap +, then Scan QR code, and point the camera at the code on your computer screen. If TherapyNotes is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan, tap +, then Enter key manually in Novaz. Type "TherapyNotes" as the Service, your username as the Account if you like, and the text token as the Setup key. See What is a 2FA setup key?
- Back in TherapyNotes, type the code Novaz shows to finish enrolling.
TherapyNotes' help doesn't say how long its codes last or how many digits they have. Scanning the QR code is the safer choice, because it passes those settings to Novaz. A key typed by hand always gets 6 digits every 30 seconds.
TherapyNotes also suggests that iPhone users on iOS 15 or later can skip a separate app and keep the code in Apple's Passwords app. That works too. For the trade-offs, see Apple Passwords vs. an authenticator app.
When TherapyNotes asks for a code
After you enroll, the login page asks for your practice code, username and password, then a token. Type the current code from Novaz and click Submit Token and Log In (TherapyNotes).
Each browser that signs in with a token is remembered for 30 days. You'll also be asked for a token when you sign in from a new browser or device. For the five days before a browser's 30 days run out, TherapyNotes asks for a fresh token once a day. A Skip for now link lets you put it off, but once the 30 days are up you have to enter one.
The 2FA for prescribing controlled substances (EPCS) is separate from your account's 2FA and uses Duo Mobile (TherapyNotes). This guide covers only the sign-in token.
If your practice requires 2FA
A Practice Administrator can turn on Require two-factor authentication for all practice users when logging in under Settings > Security, then click Save Custom Security Settings. They have to enroll their own account first (TherapyNotes). With the requirement on, you can still remove 2FA from your own account, but TherapyNotes makes you enroll again at your next login.
No backup codes
TherapyNotes' help pages don't mention backup or recovery codes. If you lose your phone, your way back in is a person: your Practice Administrator or TherapyNotes support. Unless you've backed Novaz up with iCloud backup or a backup file, its keys live only on that iPhone, so know who your administrator is before you need them.
If TherapyNotes rejects your code
TherapyNotes' own advice is about time. Codes depend on your phone's clock matching the real time, and a clock you've set by hand can cause errors. On iPhone, open Settings > General > Date & Time and turn on Set Automatically (TherapyNotes). Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
If you lose your authenticator
- You're a regular user: contact your Practice Administrator. They can open Staff, choose your name, and click Remove Two-Factor Authentication under Security & Activity. You then enroll your new phone at your next login (TherapyNotes).
- You're the only Practice Administrator: contact TherapyNotes support (TherapyNotes). Its help lists support@therapynotes.com and (215) 658-4550 x5 (TherapyNotes). The 2FA article doesn't say what proof support asks for or how long it takes.
More in Lost the phone with your authenticator app?
Changing phones
TherapyNotes doesn't describe moving the token to a new phone. While you can still sign in, remove 2FA (below) and enroll again with the new phone. With a Novaz iCloud backup or backup file, you can instead restore your accounts on the new iPhone and keep the same codes. See How to transfer your authenticator app to a new iPhone.
Turning 2FA off
Click Profile, then under Security & Activity click Remove Two-Factor Authentication. Enter your TherapyNotes password and click Remove (TherapyNotes). Then open TherapyNotes in Novaz and tap Remove account.
