Configuration

Overview · Installation · Usage · Developer notes · FAQ

Open Add-ons → Manage add-ons → Login Security: 2FA & Passkeys. The General tab starts with an overview: how many administrators use two-step sign-in, a link to the Login security page and a reminder of the recovery options.

General

Setting	Default	Description
Enable two-step sign-in	On	Off skips the second step for everybody and hides the passkey buttons. Methods and codes are kept.
Administrators	Required	Required: an administrator without a method sets one up right after the password at the next sign-in. Optional: administrators turn it on in their profile. Off: never asked (methods are kept). Applies to the main administrators and, in CS-Cart Ultimate, to storefront administrators.
Vendor administrators (Multi-Vendor)	Optional	The same choice for the vendor panel.
Customers	Optional	Optional lets customers turn it on on their Sign-in security page. Required asks every customer with an account to set it up at their next sign-in; new registrations and accounts created at checkout are not interrupted, they are asked at the next sign-in.
Authenticator apps (TOTP)	On	Codes from Google Authenticator, Microsoft Authenticator, 1Password, Authy and similar apps.
Passkeys	On	Face ID, Touch ID, Windows Hello, Android screen lock, security keys, as a second step and for passwordless sign-in.
Passwordless passkey sign-in on the storefront	On	A Sign in with a passkey button under the sign-in form (pop-up, sign-in page, checkout). Customers who added a passkey sign in with it and no password.
Passwordless passkey sign-in in the admin and vendor panel	On	The same button on the panel sign-in page.
Name shown in authenticator apps	(company name)	The issuer name your users see in the app and when they save a passkey. Empty uses the company name from Settings → Company.

If you switch a method off, users who already set it up keep using it, so nobody loses access; new setups of that method are no longer offered.

Protection

Setting	Default	Description
Trusted devices: skip the second step for (days)	30	Users can tick Don’t ask again on this device on the second step. 0 switches trusted devices off. Users sign out of all trusted devices on their security page; an administrator reset removes them too.
Allow trusted devices for administrators and vendor administrators	Off	Off: administrators and vendor administrators confirm every sign-in.
Wrong codes before the second step is locked	5	Counted per account within the lock duration (3 – 20).
Lock duration (minutes)	15	The second step of the account is locked for this time and the parked sign-in is dropped. The password is always needed first, so a lock never shuts anyone out for good.
Passkey user verification	Preferred	Required: the device must check the fingerprint, face or PIN every time it is used as a second step. Passwordless sign-in always requires it.
Refuse passkeys whose signature counter goes back	On	Security keys count their uses. A counter that does not grow points to a cloned key, and the sign-in is refused. Synced passkeys do not count and are not affected.
E-mail users about security changes	On	E-mails for new sign-in method, method removed and recovery code used. Lock e-mails and reset e-mails are always sent.
E-mail the store administrator when an account is locked	Off	Also sends the lock e-mail to the site administrator address of Settings → Company.
Keep the security log for (days)	90	Older log entries are removed when an administrator opens the Login security page.

The e-mails use the template Login security alert (one for customers, one for administrators and vendors) under Design → E-mail templates, where you can change the wording and design.

In CS-Cart Ultimate the policies are set once for the whole installation; storefront administrators follow the administrator policy.

License

The license status is shown in a License card at the top of the add-on page, above the tabs, so you see it on every tab. The License tab holds the key itself. The key is stored once for the whole installation.

The License card shows:

• the status in color: green when valid, blue for a development host or the 14-day period before a key is required (with the days left), amber when the license server could not be reached (with the days left) or a Marketplace number is still being verified, red when the add-on is switched off;
• in plain words what the status means and, when the add-on is (or will be) switched off, what stops: no new authenticator apps or passkeys can be added and the passkey sign-in buttons are hidden; users who already set up two-step sign-in are still asked for their code, so account security never drops;
• the licensed domain, every storefront with its result (covered, development host, not covered), the end of the updates and support period, the last and the next check, and the key in use (masked);
• the actions Enter license key / Change license key (opens the License tab), Check now (verifies at once and stays on the page), Manage license (your licenses on cs-cart.kaviolabs.com) and, without a valid license, Buy a license.

In Add-ons → Manage add-ons the add-on’s row shows a small license badge next to its name, for example License: Valid or License: Pending · 9 days left. The Login security, Security log and My sign-in security pages show the license status in a bar at the top.

Setting	Description
License key	Your Kavio Labs license key (KAVIO-XXXX-XXXX-XXXX-XXXX, from My licenses on cs-cart.kaviolabs.com) or your CS-Cart Marketplace license number. If you entered the Marketplace license number in Add-ons → Manage add-ons (the add-on’s license field), leave this empty: the add-on uses that number.
License status	Points to the License card and explains what the check sends.

What the license covers. A license is bound to the base domain you entered at purchase (for example example.com) and covers every subdomain of it (www.example.com, shop.example.com, staging.example.com). Local development hosts are always allowed: localhost, 127.0.0.1 and other private IP addresses, and host names ending in .localhost, .test, .local, .example or .invalid. A store on a different base domain needs its own license. If you move your store to a new domain, contact support.

When the add-on checks. When you save the key, and then once a day. The check runs only in the admin panel (on a page you open) or from cron, never while customers browse the storefront or sign in, and takes a few seconds at most. A cron job keeps the license verified even when nobody opens the admin panel:

php /path/to/store/admin.php --dispatch=kv_login_security_2fa_license.check

What is sent. The check sends this to https://cs-cart.kaviolabs.com and nothing else: the license key, the add-on ID and version, the host names of your storefronts, your CS-Cart version and edition, and a random one-time value. No customer, account, order or personal data is sent. The server answers with a digitally signed result, so a forged answer is ignored.

Statuses.

Status (card)	Color	What happens
Valid	Green	The license is valid for this domain. Everything works.
Development host	Blue	The store runs on a local development host, which every license covers. Everything works.
Pending verification	Amber	A CS-Cart Marketplace license number was accepted, but the Marketplace has not confirmed it yet. Everything works.
Pending · N days left	Blue	No verified key yet (a new installation). Everything works for 14 days.
Grace period · N days left	Amber	The last checks failed (for example a network problem). The add-on keeps working for 14 days after the first failed check.
Not activated, Invalid key, Revoked, Domain mismatch, Not verified	Red	No new authenticator apps or passkeys can be added, the forced setup of the required policy pauses and the passkey sign-in buttons are hidden. Users who already set up two-step sign-in are still asked for their code or passkey, recovery codes keep working and methods can still be removed: account security never drops and nobody is locked out. Domain mismatch shows the licensed domain next to the domain your store runs on.

When your updates and support period ends, the add-on keeps working. Only updates and support stop.

License information appears in the admin panel only, and only for administrators who may manage add-ons; vendors and customers never see it.