Foundation · 2 min
What you need to know
What is authentication?
Authentication is the process of proving that a person or system is the identity it claims to be. Examples include passwords, passkeys, one-time codes, and security keys.
Authentication vs authorization: what’s the difference?
Authentication verifies identity; authorization decides what that verified identity may do. A valid login should not automatically grant access to every order or setting.
How should ecommerce admin users sign in securely?
Admin users should use individual accounts, phishing-resistant MFA where practical, protected recovery and monitored sessions. Shared administrator credentials weaken accountability and revocation.
What is multi-factor authentication?
Multi-factor authentication requires evidence from at least two different factor types, such as a password plus a possession-based authenticator. Two passwords are not two factors.
Should ecommerce administrators use MFA?
Yes. Administrators can access high-impact data and settings, so MFA should be required, with stronger methods for the most privileged roles.
What is passwordless authentication?
Passwordless authentication signs a user in without a memorized password, often using a passkey, security key or verified one-time link. Security depends on the method and recovery design.
Should customer accounts support passwordless login?
It can reduce password reuse and support friction when implemented safely. Protect the customer’s email, phone, device registration and recovery path because those become central to account access.
Why are legitimate users unable to sign in?
Legitimate sign-in can fail because of expired codes, time drift, delivery problems, changed contact details, rate limits, device issues or fraud controls. Diagnose the step without weakening protection for everyone.
A quick store check
Test administrator sign-in, MFA, recovery, lockout and support escalation using both a normal account and a deliberately suspicious attempt.
Foundation · 2 min
Frequently asked questions
Is SMS always strong enough for administrator MFA?
Use the strongest supported method proportionate to risk; phishing-resistant authenticators are preferable for highly privileged access.
Should support bypass authentication for urgent orders?
No. Use a verified recovery process rather than giving support an undocumented bypass.