OpenSRS 2FA: how to set up an authenticator app

OpenSRS is the Tucows wholesale platform that resellers use to sell domains, hosted email and certificates. Your OpenSRS reseller login opens the Reseller Control Panel, and two-factor authentication (2FA) there is optional. You can use an authenticator app, text-message codes, or both (OpenSRS). This guide covers the reseller login, then the separate 2FA in OpenSRS webmail. The app steps use Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the OpenSRS steps come from OpenSRS's own help center, linked below, which we read on October 22, 2026. Some links from older OpenSRS pages redirect to this help center now. We haven't tested the steps on an OpenSRS account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Before you start: one login per person

If several people share one reseller login, give each person their own user before you turn on 2FA, because OpenSRS says time-based tokens can't be shared between users (OpenSRS). Then sign in as the user you want to protect.

Turn on 2FA with an authenticator app

OpenSRS describes these steps (OpenSRS):

1. In the Reseller Control Panel, open the Account settings tab and click Edit next to 2-Factor authentication.
2. Select Enroll authenticator app.
3. Enter your reseller account password and click Next.
4. OpenSRS shows a QR code and, next to it, a key you can type instead. In Novaz, tap +, then Scan QR code, and point the camera at the code. If the code is on your iPhone's own screen, take a screenshot, tap +, then Choose a photo (scanning a QR code on the same iPhone).
5. To type the key instead, tap +, then Enter key manually in Novaz. Type OpenSRS as the Service and paste the key into Setup key. OpenSRS doesn't say how often its codes change, so the QR code is the safer choice (What is a 2FA setup key?).
6. Type the six-digit code from Novaz and click Enable.
7. Print the recovery codes OpenSRS shows, or store them somewhere safe.

If you also enroll SMS, the method you set up last becomes the default. To change it, go back to Edit next to 2-Factor authentication and choose Change default login method (OpenSRS).

When OpenSRS asks for a code

After you enter your username and password and click Log in, OpenSRS asks for a token. This happens in the Reseller Control Panel and in the Classic Reseller Interface (OpenSRS). Its help doesn't mention remembering a device, so expect the prompt each time you sign in.

Recovery codes work only once, and switch 2FA off

OpenSRS also calls these emergency tokens. Keep them away from your phone; they're your way in if it's lost without a current Novaz backup. Signing in with one turns 2FA off for your account, so set up the authenticator again right after you're in (OpenSRS).

If you didn't save the codes, you can make a new set while you can still sign in. On the Account settings tab, click Regenerate recovery code next to 2-Factor authentication, enter your password and click Generate recovery codes. The old set stops working. More in 2FA backup codes.

If OpenSRS rejects your code

OpenSRS's reseller pages don't cover rejected codes. Its FAQ notes that codes are made on your phone from the key, offline, so a wrong clock is the usual cause. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones or turning 2FA off

To turn 2FA off, click Edit next to 2-Factor authentication, select Disable authenticator app, and enter your current password and a new one. Turning off 2FA resets your password (OpenSRS).

OpenSRS doesn't describe a separate way to move the authenticator to a new phone. The documented route is to turn it off and enroll it again. Do that while you still have the old phone, unless you have a Novaz iCloud backup or backup file to restore on the new iPhone (How to transfer your authenticator app to a new iPhone).

If you lose your authenticator

Sign in with a recovery code, then enroll the new phone. OpenSRS says recovery codes are the only way to sign in without contacting support. Its pages don't say what support asks for or how long it takes, so contact OpenSRS Support through its help center (OpenSRS). See also Lost the phone with your authenticator app?

OpenSRS webmail is a separate login

If you sign in to email at mail.hostedemail.com, that mailbox has its own 2FA. Your reseller turns it on for your brand first (OpenSRS). In webmail, select Settings, then Password, then Two-factor authentication. Choose Enable with Google Authenticator (other TOTP apps work too), enter your password, scan the QR code and enter the code. Webmail then signs you out, and the next sign-in asks for a code (OpenSRS).

While webmail 2FA is on, a new password doesn't take effect until you turn 2FA off. The webmail pages don't mention recovery codes: if you lose your phone, ask your reseller to bypass 2FA (OpenSRS).

Official OpenSRS help

• Two-Factor Authentication Setup for Reseller Accounts
• FAQ on Two-Factor Authentication (2FA) for Reseller Accounts
• Set Up Two-Factor Authentication (2FA) in OpenSRS Webmail
• Webmail Security FAQ: 2FA and App-Specific Passwords
• Enabling Email Security in the Mail Administration Console