What is Two-Factor Authentication?

Two-factor authentication (2FA) asks for a second proof after the password: a 6-digit code from an authenticator app on the person's phone, such as Google Authenticator or Microsoft Authenticator. Even if someone steals or guesses a password, they can't sign in without the phone.

With the module on, you decide for each kind of account whether 2FA is Off, Optional or Required:

• Admins (you and your staff)
• Vendors (on a marketplace)
• Customers

Settings are at Settings → Modules → Two-Factor Authentication → Configure. Each person sets up their own 2FA from their account's Security page.

Good to know

• Once someone turns on 2FA, it stays on for them even if you later switch the module off. Switching the module off only stops new sign-ups to 2FA.
• Authenticator apps are the supported method. The settings also list email and SMS codes, marked coming soon.
• 10 backup codes are given when 2FA is set up, for when the phone is lost.
• Five wrong codes lock the second step for 15 minutes.

Not available yet

• An admin cannot reset another staff member's or customer's 2FA. If someone loses their phone and their backup codes, contact CartWhizz support.