Shopify Two-Step Authentication: Authenticator App Setup

Shopify asks for two-step authentication before you can accept payments through Shopify Payments, and a phone lost without a backup can keep you out of sensitive actions until your account is recovered. This guide walks the whole sign-in setup in order: which methods you can still choose, how to set up an authenticator app, where recovery codes and passkeys fit, what to do with a new phone, and how to roll it out to staff, collaborators and POS.

Where to Start: Find Your Situation

Most readers arrive with one specific job. Find your situation, take the first step, then go to the section named in the last column.

Two-Step Authentication vs Passkeys: What Shopify Calls Secure Sign-In

Shopify's help center now files both under secure sign-in methods. Its secure sign-in methods page lists exactly two — passkeys and two-step authentication — and says any of them meets the requirement, while setting up more than one gives you a backup if your primary method isn't available.

The two are easy to confuse because both can involve your fingerprint or face. A passkey lets you log in with your face, fingerprint, PIN or screen lock instead of a password. Two-step authentication keeps the password and asks for a second proof, such as a six-digit code from an authenticator app. Shopify's own wording is plain:

Which Two-Step Authentication Methods Can You Set Up?

Shopify's page on logging in with two-step authentication lists five methods, and they no longer have the same status. Two can be set up from scratch, two survive only where they already exist, and one is a backup by design:

One Shopify page still disagrees about the built-in authenticator. Its own help page continues to walk you through selecting Built-in authenticator from the Authentication method list, while the two-step login page, read the same day, October 19, 2026, says it “can no longer be set up as a new method.”

Plan on an authenticator app or a security key, the two-step examples Shopify's secure sign-in methods page names. If you already rely on a built-in authenticator, treat it as a single-device method and keep a backup that doesn't depend on that device.

How Do You Set Up the Shopify Authenticator App?

Turn It On in Your Account's Security Settings

Install the authenticator app on your phone first. Then follow Shopify's authenticator app steps:

1. From your Shopify admin, click your store name, then click your profile and open Security.
2. In the Two-step authentication section, click Turn on two-step.
3. Enter your password and click Next.
4. From the Authentication method list, select Authenticator app.
5. Scan the QR code with your authenticator app.
6. Enter the six-digit code the app generates, then click Turn on.
7. Add a backup method and save your recovery codes — both are covered below.

An early-access note on Shopify's page says a refreshed admin design is rolling out gradually, so your store name may sit somewhere other than described, though only the appearance and layout change. In the Shopify app, Manage account opens your account in your mobile browser, where you tap Security.

Shopify Academy's video walks through the same screens. It was published in March 2023 and starts its setup with SMS text messages, which, as of October 2026, can no longer be set up as a new method — skip ahead to its authenticator-app chapter at 3:19, and use its backup and turning-off chapters for orientation only.

Which Authenticator App Works With Shopify?

Shopify's authenticator app page asks you to install an app that can scan QR codes on your mobile device, and lists these authenticator apps to review:

• Google Authenticator (Android, iPhone)
• Duo Mobile (Android, iPhone)
• Amazon AWS MFA
• Authenticator (Windows, Android, iPhone)

Follow the app's own setup instructions carefully: Shopify Support can't help you install these third-party apps. Once the app is on your phone, the QR code from the steps above adds your Shopify account to it.

Why Is Your Authenticator Code Not Working?

Shopify's login and troubleshooting pages give one cause for codes that keep failing, and two ways around it:

• The clock. Verify that your phone's time settings are accurate — a mismatched time can cause authentication codes to fail.
• Another method. If you set up more than one, the login screen lets you choose which to use.
• A recovery code. These are 12 digits instead of the six-digit code but work the same way, and logging in with one doesn't deactivate any of your methods.

One code that looks similar doesn't come from your app at all. When you log in after a long break, Shopify can email a 10-digit code to your account address, valid for 30 minutes — enter that one from your inbox, not from the authenticator.

Backup Methods and Recovery Codes

Shopify's setup steps mark the backup method as optional and end with saving your recovery codes. Both are what you fall back on when the primary method isn't available, so set them up in the same sitting.

Which Backup Method Should You Add?

In the Two-step authentication section of Security, click Add another method, enter your password, and choose from the Authentication method list. Shopify's backup method page offers three options:

• Shopify mobile prompts — sent to the Shopify app on your phone. They can only ever be a backup, and if they don't arrive, check that Security updates and Multi-factor authentication notifications are turned on for the Shopify app.
• Authenticator app — set up the same way as a primary one.
• Security key — you can enroll several security keys. Some keys work only on the device where you set up two-step authentication, so if you log in from several devices, add a backup of a different kind as well.

You can repeat the steps to add more than one backup. If you later remove your primary method, the next available backup becomes the primary method — which is how you move to a new phone without switching two-step authentication off.

How Do Shopify Recovery Codes Work?

Sources: Shopify Help Center pages on recovery codes (quoted below) and troubleshooting login, read October 19, 2026.

Recovery codes are for the day nothing else works — no phone, no backup. Each user on a Shopify account has a different set, so your staff's codes are theirs and yours are yours. Where you keep them matters as much as having them, and Shopify's advice is direct:

The page names a password manager or cloud storage — Dropbox, iCloud, Google Drive, LastPass or 1Password — and you can copy the codes or download them as a file called shopify_recovery_codes.txt.

Used them up, or never saved them? While you're still logged in, open Security and, in the Two-step authentication section under Recovery methods, click Regenerate codes. The new list is displayed on screen and can only be viewed one time, so copy or download it before you leave the page.

How Do Passkeys Work on a Shopify Account?

Passkeys work with Windows Hello on Windows, Touch ID on a Mac, Face ID on an iPhone, and fingerprint or screen lock on Android. Shopify's account security best practices say a passkey can help you avoid phishing scams and having your password stolen. What a passkey does not do is stand in for two-step authentication:

How Do You Add a Passkey?

You need a verified email address before Shopify lets you create one; without it the Create passkey button is unavailable. The passkey steps on a computer:

1. From your Shopify admin, click your store name, then your profile, and open Security.
2. In the Passkeys section, click Create passkey.
3. If you're prompted for verification, verify your account and click Next.
4. In the browser prompt, click Continue, then authenticate the way you unlock your device, such as Windows Hello or Touch ID.

In the Shopify app the route is your account icon, then Manage account and Security; you confirm with Face ID, fingerprint, or your device passcode or screen lock. Where the passkey is saved decides where you can use it, and the Passkeys section marks each one when that information is available:

• Synced across devices — saved to a password manager such as iCloud Keychain or Google Password Manager. You can use it on any device where you're logged in to that password manager, and it survives a lost or replaced device.
• Only on device — saved on that device alone, so you can use it only there. A passkey saved only on a computer can't be used to log in anywhere else.

You can create more than one passkey and save them on different devices or platforms, and Shopify recommends it: if you lose the device or password manager that holds your only passkey, a second passkey is what keeps you from being locked out. No Help Center page we have found states a maximum number of passkeys or security keys per account — on October 19, 2026 we read the passkeys, security key, backup method, secure sign-in and troubleshooting pages.

To log in, click Sign in with passkey on the Shopify login page, or enter your email and then choose your passkey, or use a passkey from another device by scanning a QR code.

What If a Passkey Is Lost or Stops Working?

Shopify's advice is to start with another method that's set up on your account, since a passkey is only one of several ways to log in. If the passkey was saved to your password manager rather than only to that device, log in to the same password manager on another device and use the passkey there.

Nor is there a separate recovery route for a passkey. Shopify's account recovery flow for removing two-step authentication applies only when two-step authentication is set up, and it isn't a recovery flow for a lost passkey — the practical reason to keep two-step on beside your passkeys.

How Do You Remove a Passkey?

Passkeys are removed from the Security tab, separately from your two-step methods: removing one doesn't change the other. One case blocks removal. If a passkey is your only secure sign-in method and your account is required to have one — by your organization, or because you have access to a financial product such as Shopify Balance or Shopify Credit — you can't remove it until you set up an alternative secure sign-in method.

If a passkey was created for you automatically, removing it from the Security tab also stops another one from being created for you the next time you log in.

Came here to remove the password visitors must type to see your store? That is the storefront password page, not a passkey — our FAQ on removing the password page from a Shopify store covers it.

New Phone or Lost Device: Getting Back In

The two cases differ only in timing. A planned switch costs a few minutes in Security; a phone that is already lost sends you through your backups, your codes or, as a last resort, account recovery.

How Do You Move Two-Step Authentication to a New Phone?

No Shopify Help Center page we have found describes moving authenticator entries from one phone to another — on October 19, 2026 we read the authenticator app, backup method, recovery code, deactivation, troubleshooting and secure sign-in pages. Shopify's deactivation page does say that deactivating a method can be necessary when you switch to a new device. The order below uses only what those pages document:

1. Sign in with the old phone, a backup method or a recovery code.
2. In Security, click Add another method and set up the authenticator app on the new phone.
3. Click Remove next to the old phone's method and confirm. If it was your primary method, the next available backup becomes the primary method.
4. Confirm a backup method remains and your recovery codes are still saved.

You might need to verify your identity before Shopify lets you change or remove a method.

Lost Your Only Method? Recovery Codes and Account Recovery

On the login screen, any backup method you set up is offered alongside the primary one, and a saved recovery code works in place of the six-digit code. If none of those is available — and you don't think anyone else has accessed your account — Shopify's account recovery flow is:

1. Go to accounts.shopify.com, select Your store, and enter your current login credentials.
2. When prompted for a security method, select Use a recovery code — you can choose it even if you no longer have any saved codes.
3. Click Recover my account.
4. Enter the 6-digit verification code sent to your account email address, then click Verify.
5. If more information is needed, verify your identity through Stripe's verification portal.

Your request is reviewed before access is restored. Until then you can't complete sensitive actions such as deactivating your store, and resetting your password won't shortcut the process: a reset doesn't remove two-step authentication.

The flow sends that code to your account email, so it assumes you can still read it. If that inbox is gone too, our FAQ explains what happens when two-step authentication and email access are both lost.

When Is It Required, and Can You Turn It Off?

Whether you must have it is a question with its own page — our FAQ on whether Shopify requires two-step authentication answers it in full. In short: using Shopify Payments to accept payments requires two-step authentication on your Shopify account, an admin can require a secure sign-in method for you, and Shopify can require two-step authentication on some accounts without saying why. The table shows what each requirement means for switching it off.

To turn it off where nothing holds it, open Security, click Remove next to each method and confirm. On Shopify Payments, Shopify's payments setup page warns that deactivating two-step authentication exposes your account and financial information to potential criminal attacks, and Shopify's two-step deactivation page adds that without it your payouts might be placed on hold.

Shopify's pages word the financial-products condition two ways. The Shopify Balance eligibility page and the Shopify Credit getting-started page each say you must have two-step authentication activated on your Shopify account; the secure sign-in methods page says financial products such as Balance and Credit require a secure sign-in method, which a passkey also meets. All three were read on October 19, 2026.

The setup that satisfies all three pages is two-step authentication, with a passkey beside it if you like — the same pairing Shopify recommends to every passkey user.

Rolling It Out to Staff, Collaborators and POS

Shopify ties two-step authentication to each person's own login, not to your store. That shapes everything below: you decide whether someone must use a secure sign-in method, but each person sets up and manages their own methods and codes.

How Do You Require It for a Staff Member?

The requirement lives on each user's page in the admin:

1. From your Shopify admin, go to Settings › Users.
2. Click the user you want to change.
3. Warn the person first — switching it on logs them out of Shopify. Then turn on Secure sign-in method on the user's page and save.

In Shopify adminOpen in your store

1. Settings
2. Users

Zoom

In Shopify adminOpen in your store

1. Settings
2. Users

Zoom

The text under that switch sums it up: it requires “a secure sign-in method, like a passkey or two-step authentication, to log in to Shopify,” and it “doesn't apply to Shopify POS.” Shopify's POS security page, though, says POS might show a two-step warning when two-step authentication is required for all users or for the user who logged in to the POS device. None of the pages we read reconciles the two; clearing the warning is covered in the POS section below. Shopify's help page for this setting describes it as a choice between required and not required; in the admin we checked on October 19, 2026 it is a single switch.

The setting applies to each user individually and doesn't depend on their role. For new staff, a required setting is recommended by default — they're prompted to set up two-step authentication when they log in — and you can switch it off when you add them. Changing an existing user from not required to required logs them out of Shopify, so check they aren't in the middle of a task.

What you can't do is manage their methods. You can't view or change the phone number, authenticator app or recovery codes a staff member set up, and you can't turn on two-step authentication for them. Removing someone and re-inviting them with the same email doesn't reset it either. A staff member who loses their method recovers their own account, and Shopify Support can assist only the store owner or organization owner with login issues.

An older Shopify ID migration page still answers “No. Staff can't be forced to use two-step authentication.” The current users security page and the Plus requirement page, both read on October 19, 2026, describe exactly that requirement. Follow the current pages.

On Plus: Require It for Everyone and Reset Locked-Out Users

Requiring a secure sign-in method for all users is available only to organizations on the Shopify Plus plan. It sits under Settings › Users › Security, in the Organization security block, and passkeys and two-step authentication both count. Once it's on, all users must set up a secure sign-in method before they can log in, so tell the team before you switch it.

In Shopify adminOpen in your store

1. Settings
2. Users
3. Security

Zoom

The requirement isn't enforced for four kinds of user, even when it's set for everyone:

• legacy staff;
• POS app only users;
• users that are required to use SAML authentication — see our FAQ on whether Shopify supports single sign-on;
• users logging in to versions of the mobile Shopify app older than version 8.72.0.

You can't remove the requirement for all users in bulk — only user by user. Plus organizations can also reset a locked-out user's two-step authentication from that user's page in the admin, so the person skips the account recovery flow. It works only for users whose email address uses a domain your organization has verified, and each subdomain must be verified separately; a staff member on a public address such as Gmail still needs a recovery code or account recovery.

Do Collaborators Need Two-Step Authentication?

Shopify's collaborator accounts page puts it plainly: without two-step authentication activated, collaborators cannot log in to your store. The requirement sits on the collaborator's own account, so there is nothing for you to switch on. Collaborators sign in from their Dev Dashboard or the Shopify mobile app, and they have no access to the Shopify POS app or the Point of Sale channel.

For an agency, that means every person who works on client stores needs their own login with two-step authentication and their own recovery codes, since each user's codes are separate. Whether to give someone a collaborator account or a staff seat at all is a separate decision — our guide on what a collaborator account is compares the two.

Does POS Staff Need It? PIN vs Two-Step

A staff member's PIN — 4 to 6 digits, created for each person — is what opens Shopify POS day to day, and it is separate from two-step authentication on their account. But when two-step authentication is required for your store or for a user account, logging in to Shopify POS itself may ask for it.

If your store requires two-step authentication for all users, or for the user who logged in to a POS device, POS may show a warning dialog and banner after the PIN is entered — but only on devices where that user logged in before setting up two-step authentication. To clear it, Shopify's POS security page says a user with permission to log in to Shopify POS logs out of each affected device, then immediately logs back in and completes two-step authentication.

On Plus, POS app only users aren't covered by the all-users requirement. Who can manage POS staff in the first place is covered in our FAQ on who can manage Shopify POS staff.

Your Secure Sign-In Checklist

Steps one to four apply to every account, including your staff's and your collaborators' own. Step five is for owners and admins with staff, and step six only if you sell in person with Shopify POS. On an SMS-only account, finish step one before you remove anything.

The Bottom Line

The fast ways back into a Shopify account run through something you set up in advance: a backup method, a recovery code, a second passkey. Account recovery, which needs none of them, goes through a review and blocks sensitive actions until it finishes.

Frequently Asked Questions