In Shopify admin, click your store name, select your profile, and go to Security > Turn on two-step. Choose Authenticator app, scan the displayed QR code using your authenticator app, enter the generated six-digit code, and save the recovery codes Shopify provides.
If you searched for the Shopify authenticator app expecting to find one in the App Store, here is the short answer: it does not exist.
Shopify has never built its own authenticator app. What people mean by "Shopify authenticator app" is a third-party code generator like Google Authenticator that plugs into Shopify's two-step authentication process.
This guide covers which app to use, the exact setup path in the current Shopify admin, and where to find your Shopify authentication code. I will also cover how to turn Shopify 2FA on and off and what to do when you are locked out.
What authenticator app does Shopify use?
Shopify does not have a native authenticator app. But there are many third-party apps that plug into Shopify's two-step authentication system.
There is also one thing Shopify does that comes close. Shopify mobile prompts send a push notification to the Shopify app on your phone, and you tap to approve the login. It is good, and it is safer than SMS.
The only con I see here is that Shopify only allows mobile prompts as a backup method. You still need an authenticator app, a security key, or SMS set as your primary.
So the practical answer for most stores is an authenticator app on your phone, plus Shopify mobile prompts as the backup.
What is Shopify two-factor authentication (2FA)?
Shopify two-factor authentication is a process that requires a second proof of identity after your password before you can reach your admin.
Your password is something you know. The second step is something you have. For example, a code from an authenticator app.
The reason you need 2FA is simple: To tighten your security. Attackers can log in as you, using a password that leaked somewhere else.
Microsoft's research found that enabling MFA reduced the risk of account compromise by 99.22%.
I will add one clarification that saves confusion later: Shopify groups passkeys and two-step authentication together under "secure sign-in methods." They are not the same thing.
Two-step authentication adds a step after your password. A passkey replaces the password entirely. Either one satisfies Shopify's secure sign-in requirement, and I cover passkeys further down.
Types of Shopify two-step authentication
Shopify authenticator app (my default recommendation)
You install an authenticator app, scan Shopify's QR code once, and the app generates a fresh six-digit code every 30 seconds.
Codes are generated on your device, so they work without signal, on a plane, or abroad on a local SIM.
This is what I set up on client stores unless there is a specific reason not to.
Shopify security key
A physical FIDO2 or WebAuthn key that you plug in or tap. Yubico, Feitian, SoloKeys, and Touch ID on iOS devices are recommended options. This is the most phishing-resistant option available, because the key will not authenticate against a lookalike domain.
Your account has to be migrated to a Shopify ID to use security keys. And keys with biometric readers do not work in private browsing windows.
This is worth it if you handle high payout volumes or manage stores for clients.
Built-in authenticator
This uses a system that already unlocks your computer or phone: Windows Hello, Touch ID, Face ID, or a device PIN. It is quick, and there is nothing extra to buy.
The limitation is that a built-in authenticator only works on the single device you set it up on. Set one up on your laptop, and you cannot log in from your phone with it.
SMS delivery
Shopify texts you a six-digit code. The message reads "Enter XXXXXX as your Shopify authentication code," which is the exact message people are searching for when they look up "Shopify authentication code."
My advice here is to use SMS if nothing else is available to you. SIM-swap attacks are real, and codes fail when you have no signal or you are roaming.
If you also use Shop Pay, note that Shop Pay codes arrive from the same number and read "XXXXXX is your Shop verification code."
Shopify mobile prompts
A push notification lands in the Shopify app and you tap to approve or deny. I recommend it over SMS. The prompt shows you the device, location, and time of the login attempt. If it was not you, tap No, and the attempt is blocked immediately.
I set it up in every store I work for. It cannot be your primary method, though. You need an authenticator app, security key, or SMS in place first, then add mobile prompts as a second method.
Requirements: the Shopify app installed and logged in on that specific device, running a current version.
Which authenticator app should you use with Shopify?
Google Authenticator
This is the one most merchants already have. It gained cloud sync in 2023 (Android v6.0, iOS v4.0), so codes restore on a new phone once you sign in. That backup lives in your Google Account, which means your Google Account needs strong 2FA of its own.
Microsoft Authenticator
Supports cloud backup and works across Windows, Android, and iOS. A good pick if your team already runs on Microsoft 365.
Duo Mobile
Also on Shopify's list, and the one I lean on for stores that already use Duo internally.
1Password or Bitwarden
If you already pay for a password manager, storing your Shopify codes there means backup and multi-device sync are already solved. This is what I use personally.
The limitation is that your password and your second factor sit behind one master password, so that master password and its own 2FA need to be genuinely strong.
Amazon AWS MFA
This is only relevant if you are already inside the AWS ecosystem.
How to set up two-factor authentication on Shopify
Step 1: Open admin settings
Log in to your Admin. Navigate to the top right corner of your screen, click your profile icon.
Step 2: Choose security
Step 3: Enable two-Step authentication
Scroll to find the two-step authentication section. Here, click Turn on two-step, and re-enter your password.
Step 4: Scan the QR code
Pick an authenticator app as your method. Use your phone's authenticator app to scan the QR code on the screen.
Step 5: Verify and save
Finally, you need to type the 6-digit code generated by your app to verify. Also save your backup recovery codes right away.
Shopify recovery codes
Shopify gives you 10 recovery codes when you turn on two-step authentication. Each one works once. They are the only way back into your account when your authenticator app is gone.
If you closed that screen without saving them, generate a fresh set now. Go to your store name, then your profile, then Security. In the Two-step authentication section, under Recovery methods, click Regenerate codes.
The new codes display once, and you can either Copy codes or Download codes. This saves a file called shopify_recovery_codes.txt.
Where to keep them:
- In your password manager, in the same entry as your Shopify login. This is the one that actually gets used when you need it.
- In a cloud folder you can reach from someone else's device. Dropbox, iCloud, or Google Drive all work.
- Printed, in whatever drawer holds your business paperwork. Sounds old-fashioned. Has saved more than one store I work with.
How to disable or change Shopify 2FA?
The honest answer is that you usually do not want to disable it. You want to swap methods, which is a different task.
Removing a method requires you to verify your identity first, using a passkey or your current two-step method.
To remove a method on the desktop: from your admin, click your store name, click your profile, click Security. In the Two-step authentication section, click Remove next to the method you want gone, enter your password, then click Next.
Should you use a passkey instead?
Passkeys let you sign in with your face, fingerprint, PIN, or screen lock, with no password at all. They are phishing-resistant in a way codes are not, because a passkey will not authenticate against a fake login page.
To create one. Follow a similar process
- Step 1: From your admin, click your store name, click your profile, click Security.
- Step 2: In the Passkeys section, click Create a passkey, verify your password, then authenticate with Touch ID, Windows Hello, or whatever unlocks your device.
What to do in the next ten minutes
Shopify does not have its own authenticator app, so install a real one, add it, and add Shopify mobile prompts as your backup. Also save your recovery codes somewhere you can reach from a device that is not your phone.
Set aside ten minutes and do it now. Add an authenticator app or a passkey. Add a second method. Save the recovery codes into your password manager.
One last thing I would advise is to message your staff and collaborators and ask them to do the same. This is because your store is only as secure as the weakest account with access to it.
What to do in the next ten minutes?
Shopify does not have its own authenticator app, so install a real one, add it, and add Shopify mobile prompts as your backup. Also save your recovery codes somewhere you can reach from a device that is not your phone.
Set aside ten minutes and do it now. Add an authenticator app or a passkey. Add a second method. Save the recovery codes into your password manager.
One last thing I would advise is to message your staff and collaborators and ask them to do the same. This is because your store is only as secure as the weakest account with access to it.
FAQs
1. What authenticator app does Shopify use?
Shopify does not require a specific authenticator app. It supports third-party apps that scan QR codes and generate six-digit login codes, including Google Authenticator, Duo Mobile, Microsoft Authenticator, and Amazon AWS MFA.
2. Where is my Shopify authentication app?
Your authenticator app is a separate app installed on the phone or device you used when setting up two-step authentication. It is not located inside the Shopify admin. To check which authentication methods are connected, click your store name, select your profile, and go to Security > Two-step authentication.
3. How to set up an authenticator app on Shopify?
In Shopify admin, click your store name, select your profile, and go to Security > Turn on two-step. Choose the Authenticator app, scan the displayed QR code using your authenticator app, and enter the generated six-digit code. Save the recovery codes Shopify provides.
4. How to turn off two-factor authentication on Shopify?
Go to your Shopify profile’s Security page and click Remove beside the authentication method you want to deactivate, then confirm your password. You cannot remove your final secure sign-in method when it is required by your Shopify organization.
5. What is a Shopify authentication app?
A Shopify authentication app is a third-party security app that generates a six-digit, one-time code when you log in to Shopify. It adds a second verification step beyond your email address and password, helping prevent unauthorized access to your admin.
6. How to find Shopify authentication code?
Open the authenticator app you connected to Shopify and look for the Shopify entry. The six-digit code shown there should be entered on the Shopify login page. When another authentication method is configured, you can select it during login, or use a previously saved recovery code when your usual method is unavailable.
7. Why need backup codes for Shopify built-in authenticators?
Shopify calls them recovery codes, and they let you access your admin when your built-in authenticator and other authentication methods are unavailable. This is important because a built-in authenticator such as Windows Hello, Touch ID, Face ID, or a device PIN may work only on the device where it was configured; Shopify provides 10 single-use recovery codes.
About the author
Sajini Annie John
Meet Sajini, a seasoned technical content writer with a passion for e-commerce and expertise in Shopify. She is committed to helping online businesses to thrive through the power of well-crafted content.