ICDSoft 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
ICDSoft, the web host, documents two-factor authentication (2FA) in two separate places: the hosting Control Panel, where you manage your site and mailboxes, and Webmail, where each mailbox has its own switch (ICDSoft, ICDSoft). Both are optional and both use an authenticator app. ICDSoft's help doesn't describe SMS or email codes. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the ICDSoft steps come from ICDSoft's own online manual, linked below, which we read on October 24, 2026. We haven't tested them on an ICDSoft account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA for the hosting Control Panel
ICDSoft's newest article, written for Control Panel 3, gives these steps (ICDSoft):
- Sign in to your hosting Control Panel, usually at panel.example.com with your own domain (ICDSoft).
- Open Account Profile.
- Under Two-factor authentication, click Enable. A window shows a Secret Key and a QR Code.
- In Novaz, tap +, then Scan QR code, and point the camera at the screen. On the same iPhone, take a screenshot and use Choose a photo (how).
- Or tap +, then Enter key manually, name it in Service, and paste the Secret Key into Setup key. ICDSoft says the key has 16 characters, enough for Novaz. See What is a 2FA setup key?
- Back in the Control Panel, type the current code from Novaz into Generated Token and your password into Current Control Panel Password.
- Click Save.
Older ICDSoft articles end with Check the token and enable 2FA, and their screenshot shows Generated 2FA Token, so labels may differ (ICDSoft). The manual doesn't give the code length or interval, so scanning the QR code is the safer choice.
Your backup is the secret key
ICDSoft's help doesn't mention backup codes. Instead, it asks you to keep the secret key somewhere safe, because that key is how you get back in after losing your phone (ICDSoft).
Unless you back up Novaz (iCloud backup or a backup file), the key lives only on your iPhone, so copy the Secret Key into a password manager or onto paper before you click Save. Anyone with it can make your codes.
Webmail: 2FA for each mailbox
Mailbox 2FA is turned on from Roundcube or Webmail Classic (ICDSoft). Sign in to Webmail as the mailbox you want to protect, then:
- Roundcube: go to Settings > Two-factor Authentication and press Enable. Add the QR code or the Secret to Novaz, then type the code into Generated token, enter your Current password, and press Save.
- Webmail Classic: open the Options tab > Password & Security and press Enable under Two-factor authentication. Add the key to Novaz, fill in Generated token and Current password, and press Enable.
After that, Webmail asks for a code each time you sign in through that interface. Email apps that connect over POP3, IMAP or SMTP are a separate door, so ICDSoft pairs Webmail 2FA with turning off non-Webmail access, and recommends doing both if Webmail is the only way you read mail (ICDSoft, ICDSoft).
When ICDSoft asks for a code
Once 2FA is on, the Control Panel lets you in only with your password plus a code from the app (ICDSoft). The manual doesn't mention remembered or trusted devices.
If ICDSoft rejects your code
Start with your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working? If codes still fail, ICDSoft's only advice is to contact its Support Team (ICDSoft).
Changing phones
ICDSoft doesn't describe a phone switch, but the saved secret key can be added to Novaz on the new iPhone. Novaz can also bring it over itself if you restore an iCloud backup or a backup file. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
- Control Panel: add your saved secret key to an authenticator app on another device. If you don't have it, contact ICDSoft's Support Team (ICDSoft). Its support page offers email, live chat and tickets (ICDSoft). The manual doesn't say what proof of ownership Support asks for or how long a 2FA reset takes.
- A Webmail mailbox: in the hosting Control Panel, go to Mail Manager, click the Security button next to the mailbox, and use Disable in the Two-factor authentication section. This way needs neither a code nor the mailbox password (ICDSoft).
More in Lost the phone with your authenticator app?
Turning 2FA off
For Webmail, return to the same settings page (Settings > Two-factor Authentication in Roundcube, Options > Password & Security in Webmail Classic) and click Disable. You'll need a current code and the mailbox password, unless you use the Control Panel route above. ICDSoft's manual doesn't describe turning off 2FA for the Control Panel itself.
