Secure sign-in methods

A secure sign-in method helps protect your Shopify account by requiring more than just a password to sign in or confirm sensitive actions. You might be required to use a secure sign-in method if your organization's owner has enforced it, or if you have access to financial products.

Available secure sign-in methods

You can use any of the following methods:

• Passkeys: Sign in with your face, fingerprint, PIN, or screen lock. Passkeys are a more secure option and help protect against phishing. Set up a passkey.
• Two-step authentication: Add an extra verification step when you sign in, such as an authenticator app, security key, or SMS. Set up two-step authentication.

Any of these methods meets the requirement. Setting up more than one gives you a backup if your primary method isn't available.

When secure sign-in is required

Even if you don't set up a secure sign-in method on your own, you might be required to use one. A requirement can come from your organization, from access to financial products, or both. If a requirement applies, then you're prompted to set up a method, and you can't dismiss the prompt until you add one.

Organization enforcement

Your organization's owner or admin can enforce secure sign-in for all users. When enforcement is active, you must have at least one secure sign-in method to access the organization.

Financial products

If you have access to a financial product such as Shopify Balance or Shopify Credit, then you're required to use a secure sign-in method on your Shopify account. This requirement helps protect your account and your business from unauthorized access.

This requirement is separate from organization enforcement. Even if your organization doesn't require a secure sign-in method, you're still required to use one when you have access to financial products. The requirement applies to your Shopify account, so it stays active across the organizations you belong to.

When this requirement applies, you can expect the following actions:

• You're prompted to set up a secure sign-in method if you haven't already. You can't dismiss the prompt until you add a method.
• You can turn off two-step authentication from your account's Security settings, but you must keep at least one secure sign-in method as long as the requirement applies.
• You might be prompted to verify your identity again when you complete sensitive actions, such as changing your bank account or viewing card details.

Troubleshoot a verification prompt you can't complete

Refer to troubleshoot verification prompts in the Shopify admin for details.

If you've lost access to your sign-in methods, then you can recover your account by verifying your identity. Your request is reviewed before access is restored.