INWX 2FA: how to set up Mobile-TAN with an authenticator app

INWX is a domain registrar, and its customer account is where you register, transfer and renew domains and manage DNS. INWX's name for two-factor authentication is Mobile-TAN: an authenticator app on your phone makes a short-lived code that you type after your user name and password. It's optional, and INWX documents no SMS or email alternative. One thing sets it apart: once it's on, the code is needed for the INWX API too, not just the website (INWX).

INWX's English help still names Google Authenticator, but its newer German article says any app that supports the TOTP standard will do (INWX). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the INWX steps come from INWX's own knowledge base and API documentation, linked below, which we read on October 21, 2026. Its product page for Mobile-TAN was under construction that day. We haven't tested the steps on an INWX account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on Mobile-TAN

INWX's help describes where the setting is, but not each screen of the setup (INWX, INWX):

1. Sign in to your INWX customer account.
2. Open Settings, then Access details. The German help adds that the setting is on a tab called Mobile-TAN.
3. Turn Mobile-TAN on. INWX shows a key while you activate it. If it also shows a QR code, scan it: in Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
4. To use the key instead, tap + in Novaz, then Enter key manually. Type INWX as the Service, your user name as the Account if you like, and the key as the Setup key. See What is a 2FA setup key?
5. If INWX asks for a code to confirm, type the current one from Novaz.

INWX's pages don't say whether a QR code appears or how many digits its codes have. The labels above come from the English and German help, so the account screens may word them a little differently.

If you use the INWX API

This is the part to plan before you switch it on. INWX warns that after activation, both login and API access only work with the temporary code (INWX). Any script that manages your domains will stop signing in until you deal with it.

INWX's German help says what to do: write down the key when you activate Mobile-TAN and put it in the configuration file of INWX's PHP API client, which then makes a fresh code each time it connects. INWX says only its PHP client supports this, and that it makes no promises for other clients (INWX). The API reference lists a tfa field in the account.login response, with the value GOOGLE-AUTH when the code is on, and an account.unlock call that takes the code (INWX, INWX).

Store that key safely. Anyone who has it can make your codes.

No backup codes

INWX's help doesn't mention backup or recovery codes. Its only documented way back in without the app is the identity check below. Without a Novaz backup (iCloud backup or a backup file), the key exists only on your iPhone, so think about where you keep the key you wrote down at setup: in a password manager or on paper away from the phone.

If INWX rejects your code

INWX's help doesn't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

INWX lets you turn Mobile-TAN off and on at any time from the same settings page (INWX). While you still have the old phone, sign in, turn Mobile-TAN off, then turn it on again and add INWX to the new phone. If your API scripts use the key, update their configuration with the new one. Restoring a Novaz iCloud backup or backup file on the new iPhone avoids all this: the INWX entry keeps working with the same key. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

INWX support can turn Mobile-TAN off for you, but it needs proof of identity first (INWX):

• Send a copy of both sides of your ID card by email to support@inwx.com, or by fax. (The German page gives support@inwx.de and a different fax number.)
• If you only have a passport, or the address on your ID doesn't match the one in your INWX account, also send proof that you live or lived at that address. A copy of an official letter sent there is enough.

Once INWX has turned Mobile-TAN off, sign in with your password and set it up again on your new phone. INWX doesn't say how long this takes. If you've also forgotten your password, INWX has a separate reset by email (INWX). More in Lost the phone with your authenticator app?

Turning Mobile-TAN off

Sign in and go back to Settings > Access details to turn it off (INWX). Then open INWX in Novaz and tap Remove account.

Official INWX help

• What is the Mobile-Tan service and how can I activate it?
• Was ist Mobile-TAN und wie aktiviere ich es? (German)
• I have lost my smart phone, how can I deactivate Mobile TAN?
• I forgot my user name and password, what can I do?
• API documentation, Chapter 2: Methods
• API documentation, Chapter 3: Datatypes