Sign-in security and sessions

Two-factor login

Two-Factor Authentication asks for a code from an authenticator app as well as the password. Turn it on for everyone who can see orders, payments or settings. If someone loses their phone, open their account and use Reset two-factor login.

Lock-outs and blocked addresses

Security locks out repeated wrong passwords, rate-limits sign-in attempts and lets you block IP addresses.

Your own sign-ins

Settings → Sign-ins and sessions shows where your account is signed in: device, IP address and when it was last active. Sign out any device you don't recognise.

Someone else's sessions

On a staff member's account, Active sessions lists their devices. Revoke all sessions signs them out everywhere immediately, for example when they leave the company or lose a laptop.

Google sign-in for the admin

Settings → Settings → Security → Google Login (OAuth2) lets staff sign in with Google instead of a password. The Google account's email must match their admin account's email.