Customers and vendors

Customers

When Customer is Optional or Required, shoppers can set up 2FA on your storefront under My account → Security → Two-factor: scan the QR code with an authenticator app, enter the code and save the backup codes.

With Required, every customer must set it up the next time they sign in. Many Indian shoppers aren't familiar with authenticator apps, so most stores keep customers on Optional or Off.

Vendors

On a marketplace, vendors set it up in the vendor panel under Security → 2FA. Once it's on, the vendor sign-in page (password or Sign in with Google) asks for the 6-digit code every time. With Vendor set to Required, a vendor without 2FA sets it up at their next sign-in. Requiring 2FA for vendors protects their payout details.

Turning the module off

New sign-ups to 2FA stop, but anyone who already turned it on keeps being asked for a code.