Two-step sign-in with authenticator apps and passkeys for admins, vendors and customers, plus passwordless sign-in.
Available Updated Oct 20, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Login Security: 2FA & Passkeys: overview1 of 22
What it does
Login Security adds two-step verification to CS-Cart and Multi-Vendor, which have none built in. After the password, administrators, vendors and customers confirm with a code from an authenticator app or a passkey. Set a policy per role: required, optional or off. Required users set it up right after the password, so nobody is locked out. Passkeys also work as a passwordless sign-in on the storefront and in the admin and vendor panel. It covers every sign-in path: password, e-mail code and social sign-in.
How it works
Choose the policies in the settings. Users open their security page, scan a QR code or add a passkey, and save 10 recovery codes. At sign-in they enter the code, use a passkey or a recovery code, and can trust a device for 30 days. Five wrong codes lock the step for 15 minutes. Administrators reset or unlock users; the root admin is protected and an emergency switch on the server keeps owners in control. Codes follow RFC 6238; passkeys follow WebAuthn, verified on your server.
Features
Authenticator apps (TOTP): Google Authenticator, Microsoft Authenticator, 1Password, Authy and others
Passkeys as a second step: Face ID, Touch ID, Windows Hello, Android, security keys
Passwordless passkey sign-in on the storefront and in the admin and vendor panel
Required, optional or off per role: administrators, vendor administrators, customers
Forced setup after the password for required users, so nobody is locked out
10 single-use recovery codes, shown once and stored as keyed hashes
Trusted devices for 1 to 365 days, off for administrators unless allowed
Lock after wrong codes with an e-mail to the account owner
E-mails for new or removed methods, recovery codes used and resets
Admin overview per role, reset and unlock, security log
Works with password, e-mail code and social sign-in add-ons
QR code drawn on your server, secrets encrypted, no external service
Full page cache friendly; CS-Cart, CS-Cart Ultimate and Multi-Vendor, 4.17.2 to 4.21
What you get
Package
kv_login_security_2fa-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Supported
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: Multi-Vendor 4.17.2, Oct 20, 2026Tested on: Multi-Vendor 4.17.2
Requirements
PHP
CS-Cart or CS-Cart Multi-Vendor 4.17.2 – 4.21.x, PHP 7.2.5 – 8.3 with the OpenSSL extension (CS-Cart requires it anyway)
Requirement
HTTPS for passkeys. Browsers offer passkeys only on secure pages (https://, or http://localhost while testing). Authenticator apps work without HTTPS, but sign-in pages should always use it
Requirement
The server clock must be correct (NTP). Authenticator codes change every 30 seconds; the add-on accepts the previous and the next code to allow for small differences
Requirement
No cron job and no external service are needed
Core changes
None. Hooks and template overrides only
1.0.0
Oct 20, 2026
Latest
Added 10
Second sign-in step after the password for administrators, vendor administrators and customers, covering every sign-in path that ends in a CS-Cart account (password, e-mail one-time password, social sign-in, phone codes, password-recovery link).
Policies per user type: required (forced setup right after the password), optional or off.
Authenticator apps (TOTP, RFC 6238) with a QR code drawn on the server, encrypted secrets and replay protection.
Passkeys (WebAuthn, ES256 and RS256) as a second step and as passwordless sign-in on the storefront and in the admin and vendor panel.
10 single-use recovery codes stored as keyed hashes.
Trusted devices with a configurable lifetime; off for administrators unless allowed.
Lock after wrong codes, security e-mails (lock, recovery code used, method added or removed, reset).
Root administrator protection and a server-side emergency switch.
License client and self-healing upgrades.
Tested on Multi-Vendor 4.17.2. First release.
Can I lock myself out of the admin panel?
No. The second step comes after your password, and with the required policy you are asked to set up a method, not refused. If you lose your phone, use a recovery code, ask another administrator to reset your two-step sign-in, or add define('KV_LS2FA_EMERGENCY_OFF', true); to config.local.php on the server: the admin and vendor panel then skip the second step until you remove the line. A lock after wrong codes lasts 15 minutes (setting) and can only be caused by someone who knows your password.
Which authenticator apps work?
Every app for time-based codes (TOTP): Google Authenticator, Microsoft Authenticator, 1Password, Authy, Bitwarden, Apple Passwords and others. The codes are created on the phone; no SMS and no external service are involved.
What is a passkey and do I need special hardware?
A passkey is a key pair saved on the user's phone, computer or password manager and unlocked with the fingerprint, face or screen lock. Current iPhones, Android phones, Macs and Windows PCs (Windows Hello) support passkeys, as do security keys. Synced passkeys (iCloud Keychain, Google Password Manager) are available on all devices of the user.
Do social sign-in and phone codes skip the second step?
No. A Google account, a phone number or an e-mail code is one factor, just like a password. Every sign-in that ends in a CS-Cart account, including the built-in Social login, the e-mail one-time password of CS-Cart 4.21, Social Login Pro and Phone OTP Login, asks enrolled users for their second step. A passwordless passkey sign-in is the exception: the passkey with fingerprint, face or PIN already counts as both steps.
Do the mobile app and the REST API need the second step?
The Storefront REST API signs in with tokens and has no interactive page, so the second step does not apply there. Protect API access with the usual API keys.
Why does the code from my app not work?
Check that the phone's clock is set automatically. The add-on accepts the previous, current and next code. A code can be used only once: a code that just confirmed the setup can't sign in again; wait for the next one.
Does it work with the full page cache of CS-Cart 4.21?
Yes. The passkey button is the same for every visitor and all second-step pages and calls are never cached.
Will customers be forced to use it?
Only if you set the customer policy to required. The default is optional: customers decide on their Sign-in security page. New registrations and checkouts are never interrupted.
What happens if the license lapses?
Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), no new authenticator apps or passkeys can be added and the passkey sign-in buttons are hidden. Users who already set up two-step sign-in are still asked for their code or passkey, and recovery codes keep working, so account security never drops and nobody is locked out. Once the license is valid again, everything is back.
The admin panel shows a license notice.
Open Add-ons → Manage add-ons → Login Security: 2FA & Passkeys: the License card at the top says what is wrong: no key, a key for another add-on, a revoked license, or a domain that the license does not cover. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Yes. Subdomains of your licensed domain (for example staging.example.com) and local development hosts (localhost, private IP addresses, .local, .test) are covered by the same license. Passkeys are bound to the host name, so a passkey added on the live store does not work on staging: add a separate one there.
What happens if your license server is down?
Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days are the license-gated parts switched off until the next successful check; the second step of enrolled users keeps working throughout.
Does the license check slow down my storefront or checkout?
No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse, sign in or check out.
