Passkeys & Two-Factor Sign-In

Admin accounts hold your customers, money and staff data. Protect every one of them with two-factor sign-in, and make signing in easier with passkeys. Both work in the admin panel and on the storefront account pages.

Passkeys

A passkey lets you sign in with your device's fingerprint, face unlock, PIN or a hardware security key instead of typing a password. It cannot be phished, because it only works on your real domain.

Open your profile menu → Settings → Two-factor authentication. Passkeys are managed on the same security screen (customers find it under My Account → Settings).
Click Add a passkey and follow your browser or phone prompt.
Give it a name you will recognise, such as "Office laptop" or "Phone".
Next time, choose Sign in with a passkey on the login page.

Add a passkey on each device you use. Remove a passkey from the same screen if a device is lost. If you do not see the passkey section, passkeys have been switched off for this install by the administrator.

Two-factor authentication

Open Settings → Two-factor authentication and click Enable.
Scan the QR code with an authenticator app and enter the six-digit code to confirm.
Download or copy the recovery codes and keep them offline. Each code works once.

Forgot-password and the two-factor challenge always stay on the back-office host, even when your public website is served by a separate frontend.

For administrators

Ask every person with an administrative role to enable two-factor in their first week.
When someone leaves, deactivate their account first, then review the roles they held.
Public sign-up can be closed for back-office-only installs, so accounts exist only by invitation.

Passkeys & Two-Factor Sign-In