FAQ
Overview · Installation · Configuration · Usage · Developer notes
Can I lock myself out of the admin panel?
Section titled “Can I lock myself out of the admin panel?”No. The second step comes after your password, and with the required policy you are asked to set up a method, not refused. If you lose your phone, use a recovery code, ask another administrator to reset your two-step sign-in, or add define('KV_LS2FA_EMERGENCY_OFF', true); to config.local.php on the server: the admin and vendor panel then skip the second step until you remove the line. A lock after wrong codes lasts 15 minutes (setting) and can only be caused by someone who knows your password.
Which authenticator apps work?
Section titled “Which authenticator apps work?”Every app for time-based codes (TOTP): Google Authenticator, Microsoft Authenticator, 1Password, Authy, Bitwarden, Apple Passwords and others. The codes are created on the phone; no SMS and no external service are involved.
What is a passkey and do I need special hardware?
Section titled “What is a passkey and do I need special hardware?”A passkey is a key pair saved on the user’s phone, computer or password manager and unlocked with the fingerprint, face or screen lock. Current iPhones, Android phones, Macs and Windows PCs (Windows Hello) support passkeys, as do security keys. Synced passkeys (iCloud Keychain, Google Password Manager) are available on all devices of the user.
Do social sign-in and phone codes skip the second step?
Section titled “Do social sign-in and phone codes skip the second step?”No. A Google account, a phone number or an e-mail code is one factor, just like a password. Every sign-in that ends in a CS-Cart account, including the built-in Social login, the e-mail one-time password of CS-Cart 4.21, Social Login Pro and Phone OTP Login, asks enrolled users for their second step. A passwordless passkey sign-in is the exception: the passkey with fingerprint, face or PIN already counts as both steps.
Do the mobile app and the REST API need the second step?
Section titled “Do the mobile app and the REST API need the second step?”The Storefront REST API signs in with tokens and has no interactive page, so the second step does not apply there. Protect API access with the usual API keys.
Why does the code from my app not work?
Section titled “Why does the code from my app not work?”Check that the phone’s clock is set automatically. The add-on accepts the previous, current and next code. A code can be used only once: a code that just confirmed the setup can’t sign in again; wait for the next one.
Does it work with the full page cache of CS-Cart 4.21?
Section titled “Does it work with the full page cache of CS-Cart 4.21?”Yes. The passkey button is the same for every visitor and all second-step pages and calls are never cached.
Will customers be forced to use it?
Section titled “Will customers be forced to use it?”Only if you set the customer policy to required. The default is optional: customers decide on their Sign-in security page. New registrations and checkouts are never interrupted.
What happens if the license lapses?
Section titled “What happens if the license lapses?”Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), no new authenticator apps or passkeys can be added and the passkey sign-in buttons are hidden. Users who already set up two-step sign-in are still asked for their code or passkey, and recovery codes keep working, so account security never drops and nobody is locked out. Once the license is valid again, everything is back.
The admin panel shows a license notice.
Section titled “The admin panel shows a license notice.”Open Add-ons → Manage add-ons → Login Security: 2FA & Passkeys: the License card at the top says what is wrong: no key, a key for another add-on, a revoked license, or a domain that the license does not cover. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Section titled “Does the add-on work on my staging copy?”Yes. Subdomains of your licensed domain (for example staging.example.com) and local development hosts (localhost, private IP addresses, *.local, *.test) are covered by the same license. Passkeys are bound to the host name, so a passkey added on the live store does not work on staging: add a separate one there.
What happens if your license server is down?
Section titled “What happens if your license server is down?”Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days are the license-gated parts switched off until the next successful check; the second step of enrolled users keeps working throughout.
Does the license check slow down my storefront or checkout?
Section titled “Does the license check slow down my storefront or checkout?”No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse, sign in or check out.
Still stuck?
Section titled “Still stuck?”Work through the troubleshooting guide, then contact support with your CS-Cart version, edition, PHP version and the add-on version (1.0.0).