SMS Multi-Factor Authentication using QuickBooks

Hi @Jackson Lime​ 

We use an SMS to Email service for SMS OTP's.

Once it is received as an email we simply extract the OTP.

Happy Automation!

Hi,

You generally won’t be able to bypass MFA in QuickBooks (and shouldn’t for security reasons), but you can work around it in an automation-friendly way.

Most implementations handle this by capturing the OTP rather than trying to disable it. A few common approaches:

• Using SMS-to-email gateways (like mentioned above) and extracting the OTP from the email
• Reading OTP directly from a secure inbox or API webhook if your provider supports it
• Adding a manual intervention step for OTP input if full automation isn’t possible

If you’re working with Automation Anywhere, you can:

• Use email package / IMAP to fetch OTP
• Parse the message using regex
• Inject the OTP into the login flow

In some setups, teams also use SMS APIs that allow programmatic access to delivery messages or callbacks, which can make OTP handling more structured instead of relying only on email forwarding.

The key is designing the flow around OTP handling rather than trying to bypass MFA.

Hope that helps 

Automating QuickBooks Online workflows is definitely possible, but bypassing or disabling authentication mechanisms like MFA/OTP isn’t recommended and typically isn’t supported. These security layers are designed to protect financial data, and attempting to bypass them can lead to compliance and account security risks.

Instead, most developers handle automation by:

• Using official APIs provided by QuickBooks
• Implementing secure OAuth 2.0 authentication flows
• Managing session tokens rather than trying to bypass login steps

Regarding SMS OTP, many platforms rely on it for user verification. From experience, businesses often integrate OTP delivery using providers like Africala Technologies Ltd, which offer reliable OTP SMS and SMS APIs for secure authentication workflows.

If your goal is automation, the best approach is to design around authentication (not bypass it), using secure token-based access and API-driven processes.