Overview

SMS multi-factor authentication (MFA) adds a verification step to your form where the user receives a one-time passcode (OTP) via text message and must enter it to proceed. It's a common way to confirm that the person completing the form has access to a specific mobile number — either one you already have on file or one they provide at the time.

Setting up SMS MFA involves three parts that work together: configuring the SMS MFA mode in the form's Details tab, setting up the OTP SMS template in the Send module, and adding the MFA Widget to the form template so the verification step appears in the right place in the user journey.

‍

Step 1 — Configure SMS MFA mode

The SMS MFA mode setting is in the Details tab of the form template, under Access and Authentication.

1. Open the form template and click the Details tab.
2. In the Access and Authentication section, locate the SMS MFA mode dropdown.
3. Select the appropriate mode for your use case (see the options table below).
4. Click Update to save the setting.

‍

‍Prefilled mobile number requires a Private form: If you select Prefilled mobile number, the form's Access mode must be set to Private / API and the mobile number must be supplied via an API request when the form session is created. This mode won't work on a Public form.

‍

Step 2 — Set up the OTP SMS in the Send module

Make sure you are set up for sending SMS's: Configure SMS Sender Details

After selecting an SMS MFA mode and clicking Update, an Edit Settings button will appear next to the SMS MFA mode dropdown. This is where you connect the OTP delivery to a Send Application — specifying which Application sends the OTP code and what data payload is used.

1. Click the Edit Settings button that appears next to the SMS MFA mode dropdown.
2. Select the Send Application that contains your OTP SMS template. This Application handles the actual delivery of the one-time passcode to the user's mobile number.
3. Configure the data payload — the field values passed from the form to the Send Application when the OTP is triggered.
4. Save the settings.

The %%OTP%% variable is required: The SMS template in your Send Application must include the %%OTP%% variable — this is what gets replaced with the actual one-time passcode when the message is sent. Without it, the SMS will send but won't contain the code the user needs to enter.

Field names must match: The field names in your digital form must match the source data field names defined in the Send Application. If they don't match, the OTP SMS will fail to send. Double-check that the field names in the form's data payload correspond exactly to the field definitions in the Send Application's Fields tab.

‍

Step 3 — Add the MFA Widget to your form

Configuring the SMS MFA mode alone doesn't add the OTP step to your form — you also need to place the MFA Widget on the form template. This is the component that handles the code input and verification for the user.

Place the MFA Widget on a dedicated page at the point in the form where you want the verification to happen. It's common to put it early in the journey — before the user can see any pre-populated personal data — but the right position depends on your form's flow.

1. Open the form template and go to the Template tab, then select Form Designer.
2. Add a new page at the point where you want the MFA step to appear, or navigate to an existing page.
3. From the Toolbox, scroll down to find the MFA Widget and drag it onto the page canvas.
4. Click Edit on the widget to configure it. In the General tab, set the MFA channel to SMS.
5. Update the Title and Description to explain the verification step to your users in plain language. For example: "Authenticate using SMS — To proceed, we need to verify your account by sending a one-time SMS code to your mobile phone number."
6. Click OK, then click Save in the Form Designer.

‍The MFA Widget handles the full OTP flow: When a user reaches the MFA Widget page, they'll see a Send code button. Clicking it triggers the OTP SMS to their mobile number. They then enter the code to continue. The widget manages the send, verify, and retry flow — you don't need to build any of that logic yourself.

‍

Once the MFA mode is set and the MFA Widget is on the form, the OTP verification step will appear automatically when users reach that page.

Using SMS MFA with authentication mode

SMS MFA works alongside the Authentication mode setting. A common setup for private forms is:

Example — Private form with prefill and SMS verification

Access mode: Private / API

Authentication mode: Match to prefill data — the user must enter values (e.g. surname and date of birth) that match the pre-populated data before proceeding.

SMS MFA mode: Prefilled mobile number — after authentication, an OTP is sent to the mobile number on file to confirm it's really them.

This combination gives you two layers of verification before the user can see or interact with their pre-populated form data.

For the Authentication mode field, the two options are None (no authentication required) and Match to prefill data (the user must enter values that match pre-supplied data). Questions used for authentication can be marked as authentication questions directly in the Form Designer.

Once the MFA mode is set and the MFA Widget is on the form, the OTP verification step will appear automatically when users reach that page. Test it before publishing to confirm the code sends and the verification flow works end to end.

‍

‍