Two-Step Sign-In
A Code From Your Phone After the Password
A stolen password should not be enough to open your store. With two-step sign-in, your team also types a 6-digit code from an authenticator app on their phone.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
Two-step sign-in uses an authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Authy and the like): after the password, the person types the 6-digit code the app shows for Mercayo. No SMS codes, which can be stolen by moving a SIM.
- Setting it up takes a minute: scan a QR code (or type the key the screen shows), type the first code, and keep the recovery codes somewhere safe in case the phone is lost.
- Ten recovery codes, shown once, with DOWNLOAD, PRINT and COPY. Each works once. The screen shows how many are left and warns when they run low.
- Wrong codes are limited: after 5 wrong codes in 15 minutes, even a right code is refused for a while. A code that was used once cannot be used again.
- You choose who must use it: owners and admins (to start with), everyone, owners only, or optional for all. Anyone who has set it up always needs it, whatever you choose.
- A grace period (7 days to start with) lets a new team member work while they set it up; a banner on every screen tells them the date. After it, the admin takes them to set it up before they can work.
- Mercayo's own team always uses two-step sign-in, with no grace.
Enforced Twice
The rule is checked by Mercayo's servers before any admin request, and again by the database on every request. The database does not take a sign-in's word for it: it checks that the sign-in session itself passed the second step and is still open. A session that skipped the code can do nothing, and a session that has ended is refused within seconds.
Each Person's Own Page
Two-step sign-in belongs to the person, not the store: it is on Two-step sign-in in the account menu (and the phone's More sheet). There, each person sees whether it is on and since when, which stores require it of them and why, and can make NEW RECOVERY CODES, SET UP A NEW PHONE or TURN OFF (with a code, and only when no store requires it of them). One set-up covers every store they work in.
For your store
Why It Matters
Your admin holds your orders, your shoppers' names, phone numbers and addresses, and your payment settings. Passwords leak, get reused and get guessed. With a second step from a phone in the person's pocket, a stolen password alone no longer opens the account, and recovery codes mean a lost phone does not lock anyone out for good.
It matters more as your team grows. Every extra person with a password is another way in: a packer who reuses a password from a shopping site, a freelancer whose laptop is shared, a phone left unlocked at a courier counter. Requiring the second step for owners and admins (the default) protects the accounts that can change the most, and you can extend it to everyone in one setting.
An authenticator app works without mobile data or signal, which suits teams who work from godowns and markets as much as from an office. It costs your team a few seconds at sign-in and protects everything behind it.
Step by step
How It Works
Choose Who Must Use It
In Settings → Sign-In and Security → Two-Step Sign-In, choose Two-step sign-in required for (everyone, owners and admins, owners only, or optional) and the days to set up two-step sign-in a new team member gets. Save, and the rule applies to your team at once, with each person's grace counted from when they joined.
Each Person Sets It Up
From the banner's SET UP, or Two-step sign-in in their account menu, they press SET UP TWO-STEP SIGN-IN. They scan the QR code with their authenticator app (or COPY KEY and type it in), enter the 6-digit code the app now shows for Mercayo, and press TURN ON.
They Save Their Recovery Codes
Ten recovery codes appear, shown only now. They DOWNLOAD, PRINT or COPY them into a password manager, tick I have saved my recovery codes, and CONTINUE. Mercayo keeps only a scrambled form of each code, so it cannot show them again.
Sign In With the Code
After the password, the admin asks for the 6-digit code; on a phone the keypad opens and the code can fill itself in. VERIFY, and they are in. If the phone is not to hand, Use a recovery code instead lets one recovery code in, once.
A New Phone, or a Lost One
Changing phones: SET UP A NEW PHONE moves two-step sign-in to the new one. Lost phone: a recovery code lets the person in once and removes the old authenticator, so they set up the new phone straight away. Lost phone and codes: they contact Mercayo support, who check who they are before resetting it.
See Who Has It
Settings → Staff and Roles shows each person's state: Two-step on, Two-step needed or No two-step, with when they last signed in. Remind anyone who is still in their grace period before the date on their banner.
Settings
Settings You Control
All are under Settings → Sign-In and Security → Two-Step Sign-In.
Mercayo
Mercayo's Controls
Mercayo's team can require two-step sign-in for everyone in a store, or limit the grace days, with a reason your admin shows; every change is in Mercayo's audit log. Only Mercayo's owner can reset a person's two-step sign-in (after a lost phone and lost codes), never their own, always with a written reason; the reset also ends every session of that person and is recorded. Mercayo's own staff always sign in with two steps, and a support link into a store can only be made from such a sign-in.
Limits today
Good to Know Before You Start
- Codes come from an authenticator app only; there are no SMS or email codes for staff.
- Shoppers sign in with one-time codes or Google and do not use two-step sign-in.
- A store owner cannot reset a team member's two-step sign-in; Mercayo's team does it, with a reason, after checking who the person is.
- Once signed in, the admin does not ask for the code again before sensitive actions.
Questions
About Two-Step Sign-In
What if someone loses their phone?
They sign in with one of their recovery codes. That code works once and removes the old authenticator, so they set up two-step sign-in on the new phone right away, with ten new recovery codes. Their other signed-in sessions are ended, so a stolen phone's session stops too.
What if they lose their phone and their recovery codes?
They contact Mercayo support. Mercayo checks who they are before resetting two-step sign-in; only Mercayo's owner can do the reset, with a written reason, and it signs the person out everywhere. They then set it up again on their new phone.
Why not SMS codes?
A SIM can be moved to another phone by someone pretending to be you, and SMS codes can be read off a locked screen. An authenticator app's codes are made on the person's own phone, change every 30 seconds and work without signal.
Will this lock out my current team?
No. Everyone gets the grace period from when they joined, with a banner that names the date, before it is required. People already on a team when two-step sign-in arrived got their grace from that day.
Can a stolen session skip the code?
No. The code's level is checked by Mercayo's servers and again by the database on every request, against the sign-in session itself, not a claim the browser sends. A session that never gave the code can do nothing in a store that requires it.
Which apps work?
Any app that makes the standard 6-digit time-based codes: Google Authenticator, Microsoft Authenticator, 1Password, Authy and others. The app shows the entry as Mercayo. A password manager that keeps codes works too.
Does one set-up cover all my stores?
Yes. Two-step sign-in belongs to the person, so one authenticator works in every store they are part of. Each store decides whether it is required for their role there; once it is set up, it is always asked for.
Related
Related Features
- Staff and RolesInvite people by email or phone, give them roles with exactly the rights they need, switch access off at once, and hand over ownership safely.
- Activity LogEvery change your team makes to products, orders, prices, settings and more is written down by the database, in plain sentences, with filters and a CSV export.
- Store IsolationEvery store's orders, shoppers and products are walled off by the database itself, and tests prove one store can never reach another's.
- Support AccessWhen Mercayo's support team opens your admin to help, it is a time-limited session with a reason, recorded, and by default shown to you with what was changed.
More in Security and Trust: Store Isolation · Staff and Roles · Activity Log · Support Access · Encrypted Keys · Privacy and Consent
Try It on Your Own Store
Every feature is in every plan, free for 14 days.
