Overview

Email multi-factor authentication (MFA) adds a verification step to your form where the user receives a one-time passcode (OTP) via email and must enter it to proceed. It confirms that the person completing the form has access to a specific email address — either one you already have on file or one they provide themselves.

The setup mirrors SMS MFA and also involves three parts: configuring the Email MFA mode in the form's Details tab, setting up the OTP email template in the Send module, and placing the MFA Widget on the form template at the point where verification should happen.

‍SMS or Email MFA? Email MFA is a good choice when your users are more likely to have easy inbox access than mobile reception — for example, internal staff forms or workflows where users are working at a desktop. SMS MFA is generally more reliable for consumer-facing forms where mobile access is easier. Both can be enabled together for a higher level of assurance.

‍

Step 1 — Configure Email MFA mode

Make sure you have a sending domain set up: Managing Email Sending Domains

The Email MFA mode setting is in the Details tab of the form template, under Access and Authentication.

1. Open the form template and click the Details tab.
2. In the Access and Authentication section, locate the Email MFA mode dropdown.
3. Select the appropriate mode for your use case (see the options table below).
4. Click Update to save the setting.

‍

‍Prefilled email address requires a Private form: If you select Prefilled email address, the form's Access mode must be set to Private / API and the email address must be supplied via an API request when the form session is created. This mode won't work on a Public form.

‍

Step 2 — Set up the OTP email in the Send module

After selecting an Email MFA mode and clicking Update, an Edit Settings button will appear next to the Email MFA mode dropdown. This is where you connect the OTP delivery to a Send Application — specifying which Application sends the OTP code and what data payload is used.

1. Click the Edit Settings button that appears next to the Email MFA mode dropdown.
2. Select the Send Application that contains your OTP email template. This Application handles the actual delivery of the one-time passcode to the user's email address.
3. Configure the data payload — the field values passed from the form to the Send Application when the OTP is triggered.
4. Save the settings.

‍The %%OTP%% variable is required: The email template in your Send Application must include the %%OTP%% variable — this is what gets replaced with the actual one-time passcode when the message is sent. Without it, the email will send but won't contain the code the user needs to enter.

‍Field names must match: The field names in your digital form must match the source data field names defined in the Send Application. If they don't match, the OTP email will fail to send. Double-check that the field names in the form's data payload correspond exactly to the field definitions in the Send Application's Fields tab.

‍

Step 3 — Add the MFA Widget to your form

Configuring the Email MFA mode alone doesn't add the OTP step to your form — you also need to place the MFA Widget on the form template. This is the component that handles the code request and entry for the user.

Place it on a dedicated page at the point in the form where you want verification to happen. For forms containing sensitive prefilled data, it's common to place it before that data is visible.

1. Open the form template and go to the Template tab, then select Form Designer.
2. Add a new page at the point where you want the MFA step to appear, or navigate to an existing page.
3. From the Toolbox, scroll down to find the MFA Widget and drag it onto the page canvas.
4. Click Edit on the widget. In the General tab, set the MFA channel to Email.
5. Update the Title and Description to explain the step to your users in plain language — for example: "Verify your email address — We'll send a one-time code to your email address. Enter the code below to continue."
6. Click OK, then click Save in the Form Designer.

‍The MFA Widget handles the full OTP flow: When a user reaches the MFA Widget page, they'll see a Send code button. Clicking it triggers the OTP email to their address. They then enter the code to continue. The widget manages the send, verify, and retry flow automatically — no custom logic needed.

‍

Once the Email MFA mode is set and the MFA Widget is on the form, the OTP step will appear automatically when users reach that page.

‍

Combining Email MFA with authentication mode

Email MFA works alongside the Authentication mode and SMS MFA mode settings, giving you the flexibility to stack verification layers based on the sensitivity of the form. A common setup for a private form is:

‍

Example — Private form with prefill and email verification

Access mode: Private / API

Authentication mode: Match to prefill data — the user must answer identity questions (e.g. surname and date of birth) that match the pre-populated data before proceeding.

Email MFA mode: Prefilled email address — after authentication, an OTP is sent to the email address on file to confirm it's the right person.

This gives you two layers of verification before the user can access their pre-populated form data.

‍

Example — Public form with user-entered email verification

Access mode: Public

Authentication mode: None

Email MFA mode: User entered email — the user provides their email address and receives an OTP to verify it before continuing. Useful for registration or enquiry forms where you want to confirm a valid email address before processing the submission.

‍

Once the Email MFA mode is set and the MFA Widget is on the form, the OTP step will appear automatically when users reach that page. Test the Form to confirm the code sends correctly and the verification flow works end to end before publishing.

‍