In recent years, unauthorized access to company databases and systems has been on the rise, and customer data breaches have become a serious problem. Shopify stores are no exception, and many owners are likely considering setting up two-factor authentication to protect their store from the risk of unauthorized access.
"How do I set up two-factor authentication on Shopify?"
"Which authenticator app should I choose?"
To answer these questions, this article gives a thorough explanation covering the basics of authenticator apps, the concrete setup steps, and recommended apps. No specialized knowledge is required, so use this to help strengthen your store's security.
What Is an Authenticator App That Protects Shopify from Unauthorized Access?
An "authenticator app" is what you set up to strengthen your Shopify store's security and protect it from the various risks that come with unauthorized access. An authenticator app provides "two-factor authentication," which strengthens identity verification at login and prevents unauthorized logins by third parties.
The Damage That Can Result from Unauthorized Access to Shopify
If unauthorized access to your Shopify store is ever allowed to happen, it can lead to serious damage like the following.
Leaked Customer Data
Unauthorized access carries the risk of leaking customers' personal information — name, address, phone number, email address, purchase history, and more. Beyond the direct harm to customers, a leak of personal information severely damages trust in your store, and can lead to a decline in brand image and customer attrition.
Tampering with Product or Order Information
Product information registered in your store could be rewritten without authorization, or prices could be changed improperly. Order information being tampered with or deleted can also cause real harm — shipping confusion and lost sales.
Malicious Actions Like Suspending or Deleting Your Store
There's also a risk that a malicious third party could change your store's design without authorization, or, in the worst case, delete the store itself. The store you've spent years building up could be lost in an instant — that possibility isn't zero.
Fraudulent Transfers Through Changed Payout Bank Account Details
If someone gains access to your admin information and rewrites your payout bank account details to a fraudulent account, the sales revenue you should have received gets stolen. The longer it takes to notice, the greater the damage is likely to be.
Two-Factor Authentication Is Effective Against Unauthorized Access
An effective countermeasure for protecting your store from these various risks is "two-factor authentication."
Two-factor authentication is a mechanism where, in addition to logging in with the usual email address and password, you also authenticate using "a second key" that only you would know — such as a verification code shown in a smartphone app. Even if your email address and password get leaked, an attacker can't get past that second layer of authentication, which prevents unauthorized access.
Why Shopify's Standard Two-Factor Authentication Alone Isn't Fully Secure Enough
Shopify recommends setting up two-factor authentication to strengthen login security for store owners and staff. Sending a verification code via SMS is available as a standard feature, but it comes with security concerns, such as the risk of interception or impersonation.
This is where adopting a dedicated "authenticator app" is recommended. Using an authenticator app, a one-time password is generated on your smartphone, letting you achieve safer, more convenient two-factor authentication, which greatly contributes to preventing unauthorized access to your store.
How to Set Up an Authenticator App on Shopify
Here's how to set up an authenticator app on Shopify.
[Smartphone] Install a Two-Factor Authentication App
First, install an authenticator app on your smartphone. This walkthrough uses "Google Authenticator."
[Computer] Open Account Settings in the Shopify Admin
Log into the Shopify admin from your computer. Click your account name in the top right, and select "Manage account."
Image source: Shopify
Switch the menu to "Security," and scroll down to the "Two-step authentication" item. Click "Turn on two-step authentication."
You'll be asked for your account password. Enter your password and click "Next."
The two-factor authentication methods will be shown. Select "Authenticator app."
A QR code will be shown — scan it with your authenticator app.
[Smartphone] Scan the QR Code to Link It with Your Authenticator App
On your smartphone, launch your authenticator app (Google Authenticator, in this article). Tap the "+" in the bottom right, and select "Scan a QR code."
Once you scan the QR code shown in the Shopify admin, Shopify will be added, and a verification code will appear. This verification code changes to a new one every 30 seconds.
Enter the verification code shown on your smartphone into "2. Enter the code" on the "Set up two-step authentication" screen on your computer, and click "Turn on." Setup is now complete.
[Computer] Save Your Recovery Codes
Finally, 10 recovery codes made up of 12-digit alphanumeric strings will appear on screen. If, for example, you lose your smartphone, you can use one of these recovery codes to log into the admin. Save them somewhere safe — for instance, by downloading them as a file.
Once you close the recovery code window, you can confirm your authenticator app is set up.
[Computer & Smartphone] Log In with Your Authenticator App or a Recovery Code
From now on, when you log in, you'll be asked for a verification code from your authenticator app, in addition to your email address and password. If you can't use your authenticator app, you can log in using one of your 12-digit recovery codes.
If you lose your recovery codes, you can reissue them as long as you're still able to log in. Under "Security," in the "Recovery codes" section, click "Show codes" > "Generate new codes," and a new set of codes will be issued, invalidating the old ones.
3 Recommended Authenticator Apps for Shopify
Here are three trustworthy, free authenticator apps you can use for two-factor authentication on Shopify.
Google Authenticator
Image source: Google Authenticator | App Store
Google Authenticator is an authenticator app from Google, known for its simple, intuitive interface. It's widely adopted as a standard authenticator app across many web services, so it's trustworthy and easy to get started with, even for first-time users.
Since it syncs across multiple devices through your Google Account, you can still log in from another device even if you lose your smartphone.
Twilio Authy
Image source: Twilio Authy
Twilio Authy is an authenticator app well regarded for its convenience. It supports not just smartphones and tablets, but Apple Watch as well.
Your data is encrypted and backed up to the cloud, so you can easily restore it even if you lose your smartphone or switch to a new device.
Microsoft Authenticator
Image source: Microsoft Authenticator
Microsoft Authenticator is a full-featured authenticator app from Microsoft that can be used to set up two-factor authentication on Shopify. It also supports autofilling passwords, letting you consolidate the input work needed to log in.
It can also back up your authentication settings to your personal Microsoft account, so you can smoothly restore your data even when switching to a new smartphone or if you lose your device. It's a great fit for companies and sole proprietors who regularly use Microsoft services like Office 365 and Teams.
Set Up Two-Factor Authentication on Your Shopify Store with an Authenticator App
This article covered how to set up two-factor authentication using an authenticator app on your Shopify store, along with recommended authenticator apps.
Setting up two-factor authentication with an authenticator app dramatically improves your store's security level and significantly lowers the risk of unauthorized access. No special knowledge or skill is required to install and use an authenticator app.
Use this article as a reference, and set up two-factor authentication on your Shopify store with an authenticator app.
