Multi-Factor Authentication (MFA) requires admins, reviewers, and submitters/applicants to verify their identity with a second step at login, helping protect your organization's data and submissions.
Enabling MFA
To turn on MFA for your organization, contact Technical Support. Once enabled, MFA will apply to all team members and applicants logging in to your account.
Available MFA Methods
When MFA is enabled, users will be offered one of the following methods in addition to the commonly known email method:
Method | Description |
Recovery Code | A backup code that the user saves during setup (easiest for users; requires no authenticator app) |
Authenticator App | A time-based code generated by an authenticator app (e.g., Google Authenticator) |
What Users See at First Login - Recovery Code
If you've selected the Recovery Code method, the first time a user logs in after it is enabled, they'll enter their email address and password as usual. Then they'll be prompted to select a method to verify their identity, either a recovery code or via email.
What Users See at First Login - Authenticator App
If you've selected the Authenticator App method, the first time a user logs in after it is enabled, they'll enter their email address and password as usual. Then they'll be prompted to provide the code sent to their email. After they enter it, they'll receive a QR code to scan into an authenticator app, such as Google Authenticator. They will then enter the code they see in the authenticator app to log in.
Failed Attempts and Code Expiration
Codes expire after 5 minutes. Users are limited to 10 failed attempts per hour for both one-time codes and recovery codes. After a failed attempt, users can try again or switch to a different available method.
Resetting MFA
If a user loses access to their authenticator app or recovery code, they can still log in using their email code. To fully reset MFA, users should contact Submittable Support.
Interested in adding MFA to your account? Contact Submittable Support.