Two‑Factor Authentication (2FA)

What this does

When 2FA is on, signing in requires two things: something the customer knows (their password) and something they have (a one‑time code sent to them). Even if a password is stolen, an attacker can’t get in without the code.

Why it exists: subscription accounts hold billing and license details worth protecting. 2FA dramatically reduces account takeovers.

Typical use cases

• A store with valuable software licenses.
• Any site where customers store payment or personal details.

---

How to enable it

Step 1 — Open Security settings

Go to SubscriptionFlow → Settings → Security.

Step 2 — Turn on 2FA

Tick Enable 2‑Step Verification and choose a Mode:

• Optional — customers can turn 2FA on themselves from their dashboard.
• Forced — 2FA is required for all customers.

Step 3 — Allow the email method

Enable Email verification so codes can be sent by email.

Step 4 — Fine‑tune (optional)

Adjust Code Expiry, Verified Session Duration, Maximum Failed Attempts, and Resend Cooldown to balance security and convenience. You can also customize the Email Template (subject and body).

Step 5 — Save

Click Save Security Settings.

---

How customers use it

• In Optional mode, customers enable 2FA from the Security section of their dashboard and can generate Recovery Codes.
• At login, after entering the correct password, they’re asked for a one‑time code (by email, or SMS on higher plans).
• A verified session lasts for the duration you set, so they aren’t prompted on every visit.

---

Tips & Best Practices

• Start with Optional mode to let customers adopt 2FA gradually, then consider Forced for sensitive stores.

• Keep a sensible code expiry (a few minutes) — long enough to receive the email, short enough to stay secure.

• Encourage recovery codes. Prompt customers to save them so a lost device doesn’t lock them out.

• Use a friendly email template. Clear wording reduces confusion and support requests.

---

Frequently Asked Questions