Shift4Shop 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Shift4Shop, the ecommerce platform, lets you add two-factor authentication (2FA) to each admin login of your store's Online Store Manager, the back end where you run products, orders and settings. It isn't required. It works per person, not per store: every admin user turns it on for their own login, on their own phone (Shift4Shop). The only method Shift4Shop documents is a code from an authenticator app. Its help names Google Authenticator and Authy, but the setup is a standard QR code, so this guide uses Authenticator App - Novaz on iPhone. Any other authenticator app works the same way.
How we checked this guide: the Shift4Shop steps come from Shift4Shop's own help center (support.shift4shop.com redirects to its support.3dcart.com address), linked below, which we read on October 21, 2026. The main 2FA article dates from 2018. We haven't tested the steps on a Shift4Shop store, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Before you start
The 2FA article opens by asking you to set up Google's own 2-Step Verification on your Google account. That protects a Google account, not your store. The steps that follow only need the authenticator app and the QR code that Shift4Shop shows, so with Novaz you can skip the Google part.
Who can do what depends on your admin permissions (Shift4Shop, Shift4Shop):
- Full administrators see every admin user in the list, but can only add 2FA to their own login. They can turn it off for anyone.
- Limited users, such as Sales Staff or Webmaster, see and edit only their own login. Even without the Administrator Access permission, they can still open that page to set up their own 2FA.
Turn on 2FA with an authenticator app
Shift4Shop describes these steps (Shift4Shop):
- Log in to your Online Store Manager.
- In the left-hand menu, go to Settings > General > Administrator Access.
- Find your own admin login in the list and click its action wheel at the far right.
- Choose Authentication Settings. A pop-up shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If you're working on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
- Type the six-digit code from Novaz into the field in the pop-up.
- Click Enable 2 factor authentication.
A newer article from 2022 says the Account Settings page, opened by clicking your username at the top right, also lets you set up or update 2-Step Authentication (Shift4Shop). It doesn't give the steps there, so the menus you see may not match the older article exactly.
Shift4Shop's help doesn't mention a text key to type instead of scanning. Its codes are six digits and change every 30 seconds.
Signing in afterwards
You log in with your username and password as before. A second page then asks for the six-digit code from your app, and you're in once you enter it.
Separately, Shift4Shop may lock a login after a sign-in from an unfamiliar network, such as a phone or a VPN, and email an unlock link. It suggests 2FA for anyone who often logs in from a mobile device (Shift4Shop).
If Shift4Shop rejects your code
Shift4Shop's one piece of advice is the clock: if the date and time on the phone are wrong, "the authentication process will fail" (Shift4Shop). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
No backup codes
Shift4Shop's help doesn't mention backup or recovery codes, or any second method such as text messages. Without a Novaz backup (iCloud backup or a backup file), its keys exist only on your iPhone, so your safety net is another full administrator on the store who can reset your login. If you're the only one, consider adding a second you trust.
If you lose your authenticator
A full administrator can go to Settings > General > Administrator Access, open your login's action wheel, choose Authentication Settings and click Disable 2 factor authentication. Shift4Shop says this is meant for admin users who lost their phone or got locked out (Shift4Shop). You can then log in with your password and set up 2FA again.
If no other full administrator can do it, Shift4Shop's help pages don't describe a recovery route, what proof it asks for, or how long it takes. Its help center has a Submit a Ticket link, and its phishing article lists a phone line, 1-800-828-6650, that it says is staffed around the clock (Shift4Shop). More in Lost the phone with your authenticator app?
Changing phones or turning 2FA off
Shift4Shop's setup assumes one phone per admin user and doesn't describe moving the code to another one. To switch phones, turn 2FA off while you can still log in, then set it up again with the new phone. If you use Novaz's iCloud backup or a backup file, you can restore your accounts on the new iPhone instead, and the code keeps working without turning 2FA off. See How to transfer your authenticator app to a new iPhone.
To turn it off for your own login, go to Settings > General > Administrator Access, open your login's action wheel and choose Authentication Settings. The pop-up says 2FA is on. Click Disable 2 factor authentication (Shift4Shop). Then, in Novaz, open the Shift4Shop account and tap Remove account.
