Magento 2 Customer 2FA with App and Backup Codes
SKU: TWOFACTORCUSTOMER1
- one-time code by authenticator app or email
- backup codes for emergencies, reset by support
- mandatory or optional per customer group
- guests and checkout stay untouched
Einmaliger Kauf · inkl. 12 Monate Updates · zzgl. MwSt.
Magento 2 Customer 2FA: two-factor protection for your shoppers in the storefront
Magento ships two-factor authentication for administrators only. The Mironsoft Magento 2 Customer 2FA additionally protects your customers’ accounts in the storefront: after the password, the customer confirms the login with a code from an authenticator app or by email. Backup codes secure access if a device is lost, and you decide for which customer groups 2FA is mandatory. The Magento 2 Customer 2FA works with Alpine.js and needs no additional library.
Authenticator app (TOTP)
Standardised one-time codes generated by any common authenticator app.
Code by email
Alternative for customers without an app: a short-lived code sent to the stored address.
Backup codes
Single-use emergency codes the customer saves or prints during setup.
Mandatory per customer group
2FA optional or mandatory, separated by customer group, for example for B2B.
Trusted device
Optionally the browser remembers the login for a defined number of days.
Checkout untouched
Guest orders stay unaffected; only the account login is protected.
Why a Magento 2 Customer 2FA makes sense
Customer accounts contain addresses, order history, saved carts and, depending on the shop, price lists or credit limits. Stolen credentials from other services are tried automatically. A strong password alone does not help if it was reused. Merchants therefore look for a Magento 2 Customer 2FA that extends protection by a second factor.
In B2B especially, a hijacked account is expensive: orders on account, delivery addresses and prices are open to the attacker. With a second factor the password alone is worthless. The Magento 2 Customer 2FA can be offered voluntarily first and made mandatory for sensitive groups later.
Magento 2 Customer 2FA: setup in the customer account
In the account security area the customer activates two-factor login on their own. They scan a QR code with their authenticator app or choose the mail code, confirm with a first code and receive their backup codes right afterwards. The interface is built with Alpine.js and adapts to the Hyvä theme. Resetting and setting up again is possible in the account at any time.
- QR code and manual key for the app
- Mail code as an alternative without an extra app
- Backup codes right after activation
Ask for the second factor at login
After email and password, the field for the code appears. Wrong entries are counted, and after a configurable number of failed attempts the login is briefly locked. Mail codes are valid for only a few minutes and can be used once. Anyone who marks a device as trusted is not asked again there for the configured number of days.
- Limit failed attempts, short lock afterwards
- Mail code with expiry and single use
- Optional trusted device in days
Make Magento 2 Customer 2FA mandatory per customer group
In the admin you set per customer group whether 2FA is off, optional or mandatory. When mandatory, the customer is guided through setup at the next login and reaches the account only afterwards. For a transition period you can set a deadline in days. That way wholesale customers can be required to use it while occasional shoppers keep the choice.
- Off, optional or mandatory per customer group
- Transition period in days is adjustable
- Guided setup at the next login
Keep device changes and support under control
If a customer loses their phone and backup codes, your support team can reset two-factor login in the admin. The action is logged with admin user and time, and the customer receives a notice mail. The overview shows which accounts use 2FA and how many backup codes remain. Secrets are stored encrypted.
- Reset in the admin with log entry
- Notice mail to the customer after a reset
- Encrypted storage of secrets
Where the Magento 2 Customer 2FA protects in everyday shop life
Typical situations in which a second factor makes sense.
B2B accounts with price lists
Business customers with invoice purchases and individual prices are additionally secured by mandatory 2FA.
Shops with balances
Where accounts hold credit, loyalty points or vouchers, the second factor pays off especially.
Recurring orders
Accounts with saved delivery addresses and payment methods are attractive to attackers and benefit from the protection.
Privacy-minded customers
Security-conscious customers appreciate that your shop voluntarily offers more protection.
Magento 2 Customer 2FA: without and with the module
The difference to a plain password login.
| Topic | Without module | With Mironsoft Customer Two Factor Auth |
|---|---|---|
| Account protection | Password only | Password plus one-time code |
| Methods | None | Authenticator app or mail code |
| Emergency access | Reset the password by email | Backup codes and reset by support |
| Rule per group | Not possible | Off, optional or mandatory |
| Traceability | None | Log for reset and activation |
How we set up Magento 2 Customer 2FA for you
The process after you place your order.
Alignment
You decide which methods are allowed and for which customer groups 2FA is mandatory or optional.
Installation
We install the module, set up the Magento 2 Customer 2FA for your store views and add the security area to the Hyvä account menu.
Mail templates
We adapt the templates for the mail code and reset notice to your shop, per language.
Testing
We check setup, login, failed attempts, backup codes, device changes and the requirement for a test group.
Handover
Your support team receives an introduction to resetting and the admin overview.
Scope compared with admin 2FA and login modules
The built-in two-factor authentication of Magento applies to administrators only. The Magento 2 Customer 2FA acts in the storefront, on your customers’ accounts. It replaces neither registration nor a social login solution but adds a second factor to the existing login.
The module can be combined with other account modules from Mironsoft. The interface needs no additional library.
No download, but personal setup
Customer Two Factor Auth is not listed here as a ready-made download file to install yourself. The purchase is an order for a service: we contact you after the purchase, install the module in your shop and agree on methods, mandatory groups and mail templates together with you.
Frequently asked questions
Everything important about methods, backup codes, enforcement and how the purchase works.
How can I enable two-factor authentication for customers in Magento 2?
How can I make 2FA mandatory for customers in Magento 2?
Which methods does the Magento 2 Customer 2FA support?
What happens if the customer loses their phone?
How long is a code by email valid?
How many failed attempts are allowed?
Does 2FA also affect guest orders?
Does the Magento 2 Customer 2FA work with Hyvä?
Does this replace the Magento admin 2FA?
Can I download and install the module myself?
Recently Viewed Products
Magento 2 Customer 2FA – Mironsoft