Login and two-factor authentication (2FA)

Two-factor authentication (2FA) is an optional extra security measure for your Shoporama login. You can choose between an Authenticator app or SMS, and you can always turn it off again. This article explains how to set up 2FA, what methods are available, and what to do if you lose access to your phone.

What is two-factor authentication?

Two-factor authentication (abbreviated as 2FA) means that, in addition to your password, you must also confirm your login with something you have—typically your cell phone. Even if someone knows or guesses your password, they cannot log in without also having your phone.

In Shoporama, you decide for yourself whether you want to use 2FA for your own account. Each user on the shop manages their own 2FA setup. Therefore, you can have it enabled even if your colleagues don’t, and vice versa.

What 2FA methods are available?

Shoporama offers two different methods:

• Authenticator app (recommended): An app on your phone that generates a new 6-digit code every 30 seconds. It uses the open TOTP standard and works with Google Authenticator, Microsoft Authenticator, Authy, 1Password, and similar apps.
• SMS: You’ll receive a one-time code via text message every time you log in. Works only with Danish cell phone numbers.

Enable an authenticator app

Before you begin, you’ll need to install an Authenticator app on your phone. Google Authenticator for Android or Google Authenticator for iPhone are good choices, but you can use whichever app you prefer.

1. Click your name in the top-right corner of the admin panel and select Authenticator.
2. Click the Activate button.
3. Open your Authenticator app and scan the QR code on the screen.
4. Enter the 6-digit code from the app into the field and click " Approve Activation."

The next time you log in, you’ll be asked for a code from the app after you’ve entered your password.

Enable SMS authentication

1. Go to /user/sms-auth in your admin panel. The page is titled “2-step login.”
2. Check the box next to “Enable 2-step login.”
3. Enter your Danish cell phone number (without the country code).
4. Click Save.

Starting with your next login, we’ll send a code to your mobile number, which you’ll enter along with your password.

Turn 2FA off again

You can turn off 2FA at any time as long as you’re logged in:

• Authenticator app: Go to Authenticator in your profile menu and click Disable two-factor authentication.
• SMS: Go to 2-Step Login, uncheck the box, and click Save.

If you’ve lost access to your phone

If you can no longer generate codes (lost phone, new phone without a backup, or the app has been deleted), please contact us. Send an email to support@shoporama.dk from the email address associated with your account. We’ll then reset your 2FA, and you’ll be able to log in with your password and set up a new device.

Do all users need to have 2FA?

That’s up to each individual user. Shoporama doesn’t force 2FA on anyone, and as the owner, you can’t enable 2FA on behalf of your colleagues either. You can only encourage them to do so. We strongly recommend that everyone with admin access enable 2FA, especially if multiple people use the system or if you handle a large volume of orders and customer data.

Want to learn more about user management? See “Create Multiple Users in Your Store ” and “Create Security Profiles.”

Passwords and General Security

2FA does not replace a strong password; it complements it. Shoporama stores passwords encrypted with bcrypt, so even our employees cannot see your password. Older accounts are automatically upgraded to the new encryption upon your next login.

If you need to change your password, you can go directly to “Change Password” in Shoporama.

Troubleshooting

• Code rejected: Check that the clock on your phone is set to automatic time synchronization. Authenticator codes are time-based, and even a delay of a few seconds can invalidate the code.
• SMS not arriving: Make sure your cell phone number is entered correctly during two-step verification and that it’s a Danish number. Also check that your phone has service and isn’t blocking SMS messages from unknown senders.
• The QR code won’t scan: Hold your phone a little farther away from the screen and make sure there’s good lighting. Most apps also let you enter the code manually if scanning is difficult.
• Lost both your phone and your backup: Send an email to support@shoporama.dk from the email address linked to your account, and we’ll reset your 2FA.

Frequently Asked Questions

Is 2FA required to use Shoporama?

No. 2FA is optional. You can use Shoporama without 2FA, and you can turn it on or off at any time. However, we strongly recommend it for security reasons.

Does it cost anything to use SMS 2FA?

No. Shoporama covers the cost of the SMS messages. You don’t need an SMS plan, a CPSMS account, or any other integration. The Authenticator app is also free to use.

I lost my phone. How do I log in again?

Send an email to support@shoporama.dk from the email address associated with your account. We’ll manually reset your 2FA so you can log in with your password and set up a new device.

Can I force my coworkers to use 2FA?

No. Each user manages their own 2FA. As the owner, you can encourage everyone to enable it, but you cannot activate it on behalf of other users from the admin panel.

Which Authenticator app should I choose?

Shoporama uses the open TOTP standard, so any Authenticator app will work. Google Authenticator, Microsoft Authenticator, Authy, and 1Password are all good choices. Choose the one you prefer or the one your company already uses.

Can I switch to a new phone without losing access?

Yes. Before you get rid of your old phone, log in to Shoporama, disable 2FA, and re-enable it on your new phone. Many Authenticator apps (such as Authy and Google Authenticator with a Google account) can also automatically transfer codes to a new phone.

What happens to the “Forgot Password” feature if I enable 2FA?

When you enable 2FA (both Authenticator and SMS), the standard “Forgot Password” feature via email is disabled. This is to prevent anyone from bypassing 2FA simply by gaining access to your email. If you need to reset your password, this must be done manually by support.

Does SMS 2FA work abroad?

SMS messages are sent to Danish cell phone numbers. If you’re roaming abroad, it usually works fine as long as your phone can receive SMS messages. If you travel frequently or have employees abroad, the Authenticator app is a better choice because it also works without cell service.

Is it safe enough to just use a strong password?

A strong, unique password is a good starting point, but unfortunately, passwords are constantly being leaked from other services. 2FA is the best protection against a leaked password being used to log in to your store. We recommend it for owners, bookkeepers, order processors, and anyone else with admin access.

If you have any questions or need help with setup, please email support@shoporama.dk, and we’ll be happy to assist you.