Shopify Two-Step Authentication: Protect Your Store

Turn on Shopify two-step authentication in your Shopify account security settings. Use an authenticator app or security key, and save recovery codes.

Steps

1. Sign in to your Shopify account.
2. Open your account settings and go to Security.
3. Turn on Two-step authentication.
4. Choose an authenticator app, security key or text message.
5. Save the recovery codes.

Methods

Why stores need it

A Shopify login controls products, customer data, payouts and apps. Someone with access could change payout details or steal customer information. Two-step authentication is one of the most important protections for any store.

Staff accounts

Store owners can require two-step authentication for staff. Each staff member uses their own login and method, so access can be removed without changing the owner's password.

Lost your device

• Use a recovery code.
• Then remove the old method and add a new one.
• Without codes, follow Shopify's account recovery process, which checks your identity.

Apps and collaborators

Agencies and developers can use collaborator accounts with limited permissions instead of sharing your login. Review installed apps and collaborators regularly.

Phishing

Fake emails about payouts or store closures try to steal Shopify logins. Sign in by typing the Shopify address yourself.

More: Shopify phone verification and passkeys.

After turning it on, sign out and back in once to confirm your method works before you rely on it.

Shopify on your phone

The Shopify mobile app signs in with the same account and asks for a code on new devices. Keep the authenticator on a different device from the one you use to run the store when you can, so losing one phone does not lock you out of both.

Email security

Your Shopify login email can be used to reset the password. Protect it with its own two-step verification.

Shopify Plus stores can also use single sign-on through an identity provider, where two-step rules are set by the organisation's admin.

Shopify ID

Two-step settings belong to your Shopify account, used across every store you work on. Turning it on protects all those stores at once, and store owners can require it for staff accounts.

FAQ

How do I turn on Shopify two-step authentication?

Account settings › Security › Two-step authentication.

Can I require 2FA for Shopify staff?

Yes, store owners can require it.

What if I lose my Shopify 2FA device?

Use a recovery code.

Related: Shopify phone verification · passkeys · Cloudflare 2FA.