Reviewed November 3, 2026

Shopify Staff Two-Step Verification: Set It Up Before Someone Is Locked Out

Every staff account with meaningful permissions should have two-step verification on, set up with an authenticator app rather than SMS where possible, with recovery codes saved somewhere the account owner can actually reach. The part stores skip is the failure plan: at least two people should hold store owner or admin level access, recovery codes should exist for the owner account above all, and the setup should be verified by an actual sign out and sign in before the person who configured it goes on holiday. Lockouts do not schedule themselves around your launch calendar.

Security setup guides dwell on turning the feature on. Store life is governed by the day it goes wrong: the phone with the authenticator app is replaced, the only admin is on a flight, a contractor's access needs revoking in the same hour nobody can get in to revoke it. Two-step verification done without its recovery half is a door that locks from both sides.

Shopify's account system makes the owner account the root of trust for billing, domains, and staff. That concentration is sensible and dangerous in equal measure, and it means the owner account's second factor and recovery codes deserve the same off site care as the store's banking details.

Set up each account like it will be the only one working

Walk every staff member through enabling two-step verification in their own Shopify account settings, authenticator app preferred, and have them store the ten recovery codes Shopify issues in the store's password manager, labeled with the account and date. Codes are single use; when someone spends one, that is the trigger to regenerate the set, not a detail to remember for later.

Match permissions to the job on the same pass. Two-step verification on an account with sweeping permissions it never uses is protection theater. Trim staff roles to what each role touches, orders staff to orders, content staff to content, and keep full admin for the smallest possible group. The second factor guards the account; the permission set decides what a compromised account can reach.

Build the recovery path and test it

Designate the second admin now, while nobody is locked out, and confirm that person can sign in fully, second factor included, from their own device. Then run the test most stores never run: sign the owner account out and back in on a clean browser, using only the documented recovery materials. Any step that requires a phone call to the person on holiday is a failed step; write down what it should have been and fix the record.

Document where the recovery codes live, who holds the second admin account, and the support path for the worst case, in the store's operations file. Shopify support can help verify identity for account recovery, but it is a process measured in days and documents, which is another way of saying the recovery codes in the password manager are the plan and support is the apology.

Contractors, departures, and the quarterly pass

Access reviews belong on a calendar, quarterly for most stores: list every staff and collaborator account, confirm each person is still engaged, confirm each still has a working second factor, and remove what has gone stale. Departures are the sharp edge; a same day removal checklist that names store access explicitly beats a general offboarding note that assumes someone thought of it.

Collaborator accounts through partner dashboards deserve the same scrutiny, since they arrive by a different door and are forgotten by a different team. The audit question is simple and total: can you name every human who can sign in to this store today, and prove each one still should? If the answer takes research, do the research this week.

Frequently asked questions

Authenticator app or SMS codes: which should staff use?

An authenticator app is the stronger default: it is not exposed to SIM swap attacks and it works without signal. SMS is better than no second factor at all, so accept it as a fallback for a staff member who cannot run an app, and record the exception rather than leaving the account single factor.

Where should recovery codes be stored?

In the store's password manager, in the entry for that Shopify account, where the people who would need them in an emergency already have access. Not in a photo on the account owner's phone, not in a shared chat message, and not printed in a drawer nobody can identify under pressure.

What happens if the store owner loses their phone and codes?

You are into identity verification with Shopify support, with documentation and delay. That path exists and stores do recover accounts through it, but it runs on support's timeline, not your launch's. The entire setup above exists to keep you off that path.

How many admins should a small store have?

Two is the practical floor: the owner plus one trusted second admin with a working second factor. One is a lockout waiting for a lost phone, and five is a permission problem wearing a safety costume. Two, documented and tested, is the number.