Two-factor authentication for your admin account

Your admin login opens everything a thief wants: every customer name, phone and address, your order history, and the bank or InstaPay number your money lands in.

Most break-ins are not clever hacking. A reused password leaks. A phone is sold while still signed in. Someone types their password into a fake WhatsApp link. This checklist closes those doors in ten minutes.

Step 1: a password you use nowhere else

Open Access & Security → My account. In the Security card, find Password and click Change.

Make it unique, so a leak on your email or Instagram never reaches your store. Make it long rather than clever: four unrelated words beat one short word with a symbol. It must be at least 8 characters, so use a password manager and memorise only one.

Step 2: turn on two-factor authentication

A leaked password is then not enough on its own. Storix uses an authenticator app, not SMS: SMS codes follow a phone number, and a swapped SIM hands them to a stranger.

1. Install Google Authenticator or Authy, then open Access & Security → My account.
2. In the Two-factor authentication card, click Set up 2FA.
3. Scan the QR code. Cannot scan? Copy the key under Can't scan? Enter this key manually:.
4. Type the 6-digit code and click Verify.
5. Save your 10 recovery codes with Copy or Download.
6. Tick I have saved my recovery codes., click Continue, then Done.

The card now shows Enabled, and the button becomes Manage 2FA.

Step 3: protect your 10 recovery codes

They get you in when your phone is gone. Storix gives you exactly 10, each works once, and they are shown once.

• Manage 2FA shows Recovery codes remaining, and warns when 1 to 3 are left.
• On New recovery codes, Esc or a click outside closes the screen before you tick the box. The new codes are gone and the old ones already dead, so generate another set at once.
• After 5 wrong app codes in a row, app codes are refused for 5 minutes and the screen says Incorrect code — please try again. even for a correct code. Recovery codes still work.
• Keep them offline: printed, or in your password manager. Never in a WhatsApp chat.

Step 4: close sessions you no longer use

Your account stays signed in on every device you ever used: a sold laptop, a borrowed phone, a café computer. In the Security card, read Active sessions — device, city and country when known, and last use. Your own row says This device.

• Click Revoke on any row you do not recognise.
• Sign out all other devices clears everything but the device in your hand.
• After a lost phone, use Sign out everywhere, including this device, then sign back in.
• Turn on Email me on new-location sign-in, and re-read this list each month-end.

Step 5: give staff their own logins

It is per person. You cannot switch it on for your team, and nobody can switch it on for you. Each person turns it on from their own My account page. Ask them to, then check.

A shared password destroys accountability, cannot be revoked for one person, and means nothing once the code travels around a group chat. The team roles lesson shows how the owner invites people. Storix and your courier will never ask for your password or code on WhatsApp — any "verify your store now" link is phishing.

One thing Storix asks you twice

Paying for a plan from your Storix balance, and issuing or reactivating a gift card, open a Confirm money action window asking for your password and authenticator code. It stays valid for 10 minutes by default, and after it passes you click the original button again. Storix does not replay the payment for you.

Two-factor authentication, session control and new-location alerts are on every Storix plan — secure your admin account.

This lesson is general security guidance, not legal or accounting advice.

Related lessons

• Privacy and consent basics
• Incident response runbook