FortiToken Mobile, developed by Fortinet, turns an iPhone into a second-factor authenticator for corporate access. The app generates OATH-compliant TOTP and HOTP codes and supports push-based one-tap approvals to speed VPN and application logins. Key functions include QR-code provisioning, biometric lock with FaceID/TouchID, and management of multiple tokens in a single interface. It is intended for enterprise employees, IT staff, and remote workers who use Fortinet security products and need mobile MFA tied to existing infrastructure.

What the app is and where it sits in enterprise security

The app is an OATH-compliant one-time password generator that provides a second authentication layer for corporate access. The app produces both TOTP and HOTP credentials and plugs into Fortinet systems such as FortiGate firewalls, FortiAuthenticator, and FortiToken Cloud. Organizations use it as a mobile alternative to hardware tokens, allowing centralized token administration inside the developer's security stack.

How the app supports daily login workflows

The app supports both code entry and a one-tap approval workflow that lets users approve logins with a single tap, reducing manual entry during VPN or application sign-ins. It manages multiple tokens in one place and secures access to the token list with FaceID or TouchID. Standard six-digit codes generate without network access, so users can authenticate when connectivity is unavailable.

How provisioning and device changes are handled in practice

Activation commonly occurs by scanning a QR code or entering an administrator-provided code, matching standard enterprise provisioning flows. Moving tokens to a replacement device typically requires administrator re-provisioning unless the organization enables the app's Transfer Token feature. Reported user difficulty during device migration makes administrative planning important for teams that rotate or replace phones frequently.

Compatibility and operational reliability on mobile hardware

The tool runs on iOS 12.0 or later and supports iPhone, iPad, and iPod touch, fitting typical mobile deployments. Initial activation and push notifications require a network connection, while the app also accepts third-party OATH tokens such as Google and Microsoft for cross-service compatibility. Users have reported occasional stability issues after major OS updates, a factor IT teams should include in update and support plans.

Who benefits most and who should consider alternatives

The app suits organizations that prefer a centrally managed mobile MFA model and that prioritize minimal on-device data exposure, given the application's privacy-focused design that avoids accessing emails, browser history, or personal files. It aligns with deployments already committed to the developer's ecosystem. Teams that require fully self-service device transfers without administrative steps should evaluate other MFA solutions that permit end-user token migration. Plan for IT oversight during rollouts and device changes.