Skip to content
Novaz AuthenticatorGET

Shopify 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. When you have to turn it on
  2. Turn on 2FA with an authenticator app
  3. Save the recovery codes
  4. When Shopify asks for a code
  5. If Shopify rejects your code
  6. Changing phones
  7. If you lose your authenticator
  8. Turning 2FA off
  9. Official Shopify help

Your Shopify account is the login you use to run a store in the Shopify admin and the Shopify app. Shopify calls 2FA two-step authentication, and the methods have narrowed: an authenticator app or a security key, with prompts in the Shopify app as a backup. Text messages are gone for new setups, though accounts that already use SMS can keep using it (Shopify). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Shopify steps come from Shopify's own Help Center, linked below, which we read on October 19, 2026. We haven't tested them on a Shopify account, so a label may differ slightly. A refreshed admin design is also rolling out, so your store name may sit elsewhere. The Novaz steps are checked against the app, version 1.0.5.

When you have to turn it on

It's optional unless one of these applies:

  • Shopify Payments. It's required. Without it, Shopify says "your payouts might be placed on hold" (Shopify).
  • Shopify Balance or Shopify Credit. These need two-step authentication or a passkey (Shopify).
  • Your organization. Stores on Shopify Plus can require every user to have a secure sign-in method (Shopify).
  • Shopify itself. Shopify may require it without saying why, and you can't reach the admin until you set it up (Shopify).

Each person sets up their own. A store owner can't turn it on for staff (Shopify).

Turn on 2FA with an authenticator app

Shopify's help describes these steps (Shopify):

  1. In the Shopify admin, click your store name, then your profile, then Security. In the Shopify app, tap the icon next to your store name, then your name, then Manage account, and open the Security tab (Shopify).
  2. In the Two-step authentication section, click Turn on two-step. If you already have a method, the button is Add another method (Shopify).
  3. Enter your password and click Next.
  4. From the Authentication method list, select Authenticator app.
  5. In Novaz, tap +, then Scan QR code, and scan the QR code Shopify shows. On the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  6. Type the six-digit code from Novaz and click Turn on.
  7. Save your recovery codes (below).

Shopify's help only describes scanning and doesn't mention a text key. If your screen shows one, tap + in Novaz, then Enter key manually, and type it as the Setup key. See What is a 2FA setup key?

Save the recovery codes

Shopify gives you 10 single-use recovery codes, 12 digits each (Shopify, Shopify). Without a Novaz backup, its keys exist only on your iPhone, and these codes are your way back in. Copy or download them and store them away from your phone. See 2FA backup codes.

To make a new set while signed in, go to Security and, under Recovery methods, click Regenerate codes. New codes appear only once (Shopify).

A second method helps too: Add another method offers a security key or Shopify Mobile prompts, a backup-only approval in the Shopify app (Shopify).

When Shopify asks for a code

Shopify asks for the second step every time you log in, and lets you pick a method if you have several (Shopify). It can ask again before sensitive actions, such as changing your security or payment settings (Shopify). Shopify's help doesn't mention a way to remember a trusted device.

If Shopify rejects your code

Shopify's own advice is to check your phone's time settings, since a wrong clock makes codes fail (Shopify). On iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Do this before you give up the old phone, because Shopify may ask you to verify the change. On the Security page, click Add another method, choose Authenticator app, and scan the code with the new iPhone (Shopify). Then click Remove next to the old one (Shopify). Add first: if a secure sign-in method is required, Shopify won't let you remove your last one. If you use Novaz's iCloud backup or a backup file, you can skip this and restore your accounts on the new iPhone instead. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Try these in order:

  1. A backup method, such as a security key or Shopify Mobile prompts, if you added one (Shopify).
  2. A recovery code. At the login prompt, choose Use a recovery code and type one of your 12-digit codes (Shopify).
  3. Account recovery. With neither, ask Shopify to remove two-step authentication (Shopify). At accounts.shopify.com, select Your store and enter your email and password. Choose Use a recovery code even though you have none, then Recover my account (called Recover your account on another Shopify page). Type the 6-digit code emailed to you and click Verify.

Shopify may then ask you to verify your identity through Stripe, with a government-issued photo ID and a selfie. The name and date of birth must match your account (Shopify). Shopify emails you when the review starts and ends, but doesn't say how long it takes.

  • Resetting your password doesn't remove two-step authentication (Shopify).
  • Staff should ask the store or organization owner, since Shopify Support helps only owners with login problems (Shopify). On Shopify Plus, an organization that has verified its email domain can reset users on that domain from Settings > Users (Shopify).
  • If you think someone got into your account, contact Shopify Support instead (Shopify).

More in Lost the phone with your authenticator app?

Turning 2FA off

On the Security page, click Remove next to the method, verify if asked, and confirm with Remove (Shopify). You can't remove your last method while one is required, and Shopify Payments payouts may be held without it.

Official Shopify help

More guides: Marketing and sales