This is a good opportunity to a/b test the options you’re considering!
I’ve used single form, two-factor authentication logins. Here’s what I’ve observed as an end-user of those systems.
- If the user already has the 2nd factor when they begin the login process, use a single form.
- If the 2nd factor is generated by completing the first step in an authentication process, use a multi-step form.
An example of the first situation is a user at an ATM. Their two factors of authentication are the ATM card and the PIN. Since they have both, there is a single form asking for the PIN (technically, the request for the PIN is triggered by them inserting the card into the reader so this could be viewed as two steps). Another example is people using a token generator like Authy. They’ll have the token before they get to the login form.
An example of the second situation is authenticating to Gmail using a code received by text message as the 2nd factor. In that situation it isn’t possible to know the code at the time the user name and password are entered because the code isn’t sent until the first factor of authentication is verified.
If your situation allows for using a single form, then take extra care to make sure the form is clear about which data entry field is for each required piece of information. Consider putting a picture of the token generator (or app icon) to remind the user where to get their token.