A password alone is not enough to sign in to the store
An account in a wholesale store gives access to agreed prices, the credit limit and orders on deferred terms. A second sign-in factor means a stolen password alone does not sign anyone in to the store. The employee enters a code from an app or an e-mail, and on a known device is not asked every time.
Why it exists
Magento protects the seller’s panel, but not the customer’s account
In Magento the second sign-in factor exists only for the admin panel. A customer account in the store opens with the password alone. In a consumer store that is the risk of one order. In wholesale, behind that password stand the customer’s prices, the credit limit and the right to buy on invoice.
Passwords leak from other services, are written on notes by the computer and passed around the company. Whoever knows them can order goods at the customer’s expense or look up their commercial terms.
Two-factor sign-in
What it does in the store
A code from an app or by e-mail
The employee chooses an authenticator app, recommended, or a code sent to the account’s address. Protection works from the first correct code entered.
The user switches it on themselves
Every employee decides about their own account on the “Sign-in security” screen. Switching on needs the password, switching off a code.
A prompt only on a new device
After entering a code the browser can be remembered for 30 days. On a remembered computer sign-in ends with the password.
A password without a code opens nothing
Until the code is entered the cart, addresses and placing orders do not work. That includes signing in from the popup and at checkout.
A lock after wrong codes
After 5 wrong codes the account is locked for 15 minutes, and after 50 until the company administrator or customer service resets the second factor. The owner gets a message that someone knows their password.
A reset by the company or customer service
When an employee loses their phone, the company administrator resets their second factor from the employee list. The administrator’s account is reset by customer service.
Who uses it
Every role gets what it needs at work
Buyer
Switches protection on for their account and enters a code when signing in on a new device. Can sign out all remembered devices with one button.
Company administrator
Sees next to every employee whether the second factor is on, and resets it when someone loses access. Does not reset their own; for that they go to customer service.
Account manager
When signing in on a customer’s behalf from the panel, is not asked for their code. Does not reset customers’ second factors, their own customers included.
Customer service
Resets the second factor of any account from the customer record in the panel. Sees the event log: activations, deactivations, resets and locks.
A worked example
Marek from Instalbud protects his account at Delta Hurt
01 Marek switches the app on
On the “Sign-in security” screen he enters his password, scans the QR code with his phone and types the first code.
02 A new laptop, one code
He signs in on a new computer, enters the code from his phone and ticks “Remember this device”. For 30 days he enters only the password here.
03 Someone tries Marek’s password
Without a code they cannot sign in to the store. After five attempts the account locks for a quarter of an hour, and Marek gets an e-mail and changes his password.
04 The phone is lost
Ewa, Instalbud’s administrator, resets Marek’s second factor from the employee list. Marek signs in with his password and pairs a new phone.
For the IT team
Where the data comes from and how to integrate it
The code is checked when the session is created, not on a screen after sign-in. So no entrance to the store, including signing in at Hyvä Checkout and “remember me”, yields a session before the code.
The second factor’s state is visible on the customer in the REST API, and the reset and the event log have their own endpoints. The app secret is encrypted with the deployment key.
The module can be switched off for one website without wiping user settings. The admin panel’s second factor is native to the platform and is enabled in the rollout configuration.
FAQ
Questions: two-factor sign-in
Can we force the second factor on all customers?
Won’t buyers who order daily get tired of codes?
What if someone changes the e-mail address on a protected account?
Does Adobe Commerce B2B have a second factor for customers?
We will show you this on your company’s data
The demo runs on a scenario from your sales: your customers, your price lists, your ERP. After an hour you know what you get at once and what we set up in the rollout.