Installation
Overview · Configuration · Usage · Developer notes · FAQ
Requirements
Section titled “Requirements”- CS-Cart or CS-Cart Multi-Vendor 4.17.2 – 4.21.x, PHP 7.2.5 – 8.3 with the OpenSSL extension (CS-Cart requires it anyway).
- HTTPS for passkeys. Browsers offer passkeys only on secure pages (
https://, orhttp://localhostwhile testing). Authenticator apps work without HTTPS, but sign-in pages should always use it. - The server clock must be correct (NTP). Authenticator codes change every 30 seconds; the add-on accepts the previous and the next code to allow for small differences.
- No cron job and no external service are needed.
Install
Section titled “Install”- In the admin panel go to Add-ons → Manage add-ons, click the + (Upload & install add-on) button and upload
kv_login_security_2fa-1.0.0.zip. - Open the add-on settings and check the policies. By default two-step sign-in is required for administrators and optional for vendors and customers.
- Set up your own method first: Customers → Login security → My sign-in security (or open your profile, tab Sign-in security). Scan the QR code with your authenticator app, enter the code and save the 10 recovery codes.
- Enter your license key on the License tab (see License). Without a key the add-on works for 14 days.
With the required policy, every other administrator is asked to set up a method right after their password at their next sign-in. Tell your team before you install.
Upgrading
Section titled “Upgrading”Upload the new zip over the installed add-on in Add-ons → Manage add-ons (or install the Upgrade Center package). Methods, recovery codes, trusted devices and the log are kept. On the next admin page the add-on completes the upgrade by itself (new tables, settings and texts are added).
Uninstalling
Section titled “Uninstalling”Add-ons → Manage add-ons → Login Security: 2FA & Passkeys → Uninstall removes the add-on’s tables (authenticator secrets, passkeys, recovery codes, trusted devices, log), settings, e-mail templates and texts. After that everybody signs in with the password only. Passkeys saved on the users’ devices for your store can be deleted there; they no longer work.
Disabling the add-on (status Disabled) switches the second step off at once and keeps all data.