Does Shopify require two-step authentication?

When is two-step authentication actually required?

Shopify answers this in two places, and the two answers look opposite. Its organization-security page says the decision is yours; its sign-in page and its Shopify Payments pages say the platform requires it. Both are true — they describe different merchants.

Four situations decide which answer is yours:

• Nobody is enforcing it. It stays optional. Where an organization sets no requirement, the choice is left up to the user.
• You take payments through Shopify Payments. Then it is not optional at all, and this is the branch merchants miss.
• Someone with admin access has set it to required for you. Shopify documents that switch on each user's own profile under Settings > Users. Requiring it of every user at once is the version only a Plus organization has.
• You use Shopify Balance or Shopify Credit. Shopify requires a secure sign-in method for access to a financial product, and the Balance and Credit pages both list two-step authentication as an eligibility requirement.

The second branch lives on a different page from the one that says the choice is yours, which is why the two never meet:

The payments side of the documentation puts it in its own words — to use Shopify Payments, you must secure your account with two-step authentication. And the sentence quoted above turns up word for word on Shopify's account-security best practices page. So for a merchant taking card payments through Shopify's own processor, the answer is yes.

What happens if you don't turn it on?

Where nobody requires it, nothing happens — the two consequences below belong to the branches that do, and they land at two different moments. The first is access, and it is not a reminder you can dismiss: when the platform is the one asking, Shopify prompts you to set up a method the next time you log in, and you need to finish the setup before you can continue to the Shopify admin.

The second is money, and merchants tend to meet it late. Shopify's Shopify Payments account-setup page says payouts might be placed on hold until two-step authentication is activated on the store — its word is might, and it does not say when, or how often that happens in practice.

So it is worth turning it on before a payout cycle rather than during one. The product itself is covered in our guide to how Shopify Payments works.

One nearby prompt is easy to misread as two-step authentication and is not: Shopify says that if you haven't logged in for three months or more, you need to confirm your identity as part of the login process. Shopify states that requirement without any reference to two-step authentication — it is a separate check, not the two-step prompt.

Can you require two-step authentication for your staff?

For everyone at once, only on Plus. For one person at a time, Shopify documents where the switch lives but never which plans have it. Shopify's organization-security page states that requiring a secure sign-in method is available only for organizations on the Shopify Plus plan, and its user-security page says the same from the other side.

The per-user setting sits on each user's own profile. To reach it, from your Shopify admin you go to Settings > Users, open the person, and set whether a secure sign-in method is required for them. Shopify recommends the required setting for new users, so a new staff member may find it already switched on.

The plan note on that page covers only the all-users version, and Shopify states no plan requirement for the per-user one — nor that every plan has it.

Switching a user to required signs that user out. Shopify documents that changing the two-step authentication setting from not required to required logs the user out of Shopify, and its own advice is to check first that the person is not in the middle of a task. The warning is written per user, so it holds whether you flip one profile or, on Plus, everyone at once.

Which sign-in methods does Shopify count?

For a new setup, an authenticator app or a security key. Shopify's wider term is secure sign-in, whose methods can include passkeys and two-step authentication. Once two-step is on, Shopify asks for the second step, such as a one-time code, every time that you log in — a second step at each sign-in is how it is meant to work.

• An authenticator app or a security key — the two main methods you can still add. The app has to be installed on your phone first; Shopify's authenticator app steps start from Security in your account profile, and our guide walks through setting up the authenticator app. A security key needs your accounts migrated to your Shopify ID first — a setup step, not a plan tier.
• SMS or a built-in authenticator — only if already on your account. Shopify no longer lets you set up SMS as a new method, and once removed it can't be added back; its two-step login help page says a built-in authenticator works only on that device, and can no longer be set up as a new method.
• Shopify mobile prompts — backup only. Shopify says they can only be used as a backup two-step authentication method.

No plan gate appears on the method pages we read in October 2026 — SMS, authenticator app, built-in authenticator, security key, mobile prompts. Shopper sign-in on new customer accounts — a one-time 6-digit verification code, Shop credentials or a saved passkey — is a different surface, covered in our guide to the customer accounts migration.

What if you lose access to your authentication method?

Save the 10 recovery codes when you set it up. Shopify offers them at that step: they let you access your Shopify admin if any other authentication method isn't available, so keep them away from the phone that holds your authenticator app. Lose both the method and the codes and the route is slower, not closed: Shopify says you can then recover your account by verifying your identity.

For staff, a reset carries two conditions. Shopify lists "Reset two-step authentication for users" among its advanced security features, available only to organizations on the Shopify Plus plan; the reset itself works only for staff whose email address uses a domain you have verified. Everyone else — on Plus or not — completes the account recovery process for their own Shopify ID.