2FA (two-factor authentication), which we call two-step sign-in, adds a second check when you sign in to Shopstar. Your password is the first step. The second step is something only you have: your phone, or a passkey on your device. It takes about 2 minutes to set up, and from 1 December 2026 it will be required for every Shopstar account.
Set up two-step sign-inWhat is 2FA?
Think of your bank card. Someone who finds your card still can't draw money without your PIN. 2FA works the same way for your Shopstar account: a password on its own isn't enough to get in.
When you sign in, Shopstar checks two different things:
- Something you know: your password.
- Something you have: your phone or computer, which proves it's really you with a passkey or a 6-digit code.
Tip: You'll also see it called two-step verification, multi-factor authentication (MFA) or two-factor sign-in. They all mean the same thing.
How it works
Once it's on, signing in looks like this:
- 1
Enter your email and password
Just like you do today.
- 2
Shopstar asks you to confirm it's you
This screen only appears once your password is right.
- 3
Use your passkey, or type your code
With a passkey, touch your fingerprint sensor, look at your phone or enter your screen lock. With an authenticator app, type the 6-digit code it shows. Either way, you're in.
Authenticator codes are made on your phone and change every 30 seconds. Each one works only once, and they come from the app itself, not by SMS, so they work even without signal or data.
Why it's worth 2 minutes
- Passwords leak. If you've used the same password on another website and that site is hacked, criminals try it on other sites. With 2FA, the password alone doesn't work.
- It stops phishing. Fake "Shopstar" emails and WhatsApp messages try to trick you into typing your password into the wrong website. Without your phone or passkey, it's useless to them.
- It protects your shop. Your sign-in guards your products, your customers' details and orders, and where your payouts go.
- It's quick. After the first set-up you're asked only when you sign in, not on every page.
- It will be required. From 1 December 2026 every Shopstar account will need it, so setting it up now means no surprises later.
Your two options
Passkey
RecommendedSign in with your fingerprint, face or phone screen lock. There's nothing to type or remember, and it only works on the real Shopstar site, so it can't be phished. Works on most phones and computers from the last few years.
Authenticator app
A free app on your phone (Google Authenticator, Microsoft Authenticator or Authy) shows a new 6-digit code every 30 seconds. Works on any smartphone, even an older one.
You can turn on both. Many people use a passkey day to day and keep an authenticator app as a backup.
How to set up a passkey
- 1
Sign in to Shopstar
Use the phone or computer you sign in on most often.
- 2
Open Sign-in security
Click Set it up on the reminder at the top of your dashboard, or the shield icon in the top bar.
- 3
Choose "Use a passkey"
Your phone or computer asks you to confirm with your fingerprint, face, screen lock or PIN. On Windows this is Windows Hello; on a Mac or iPhone it's Touch ID, Face ID or your passcode.
- 4
Save your recovery codes
Shopstar shows you 10 backup codes. Download, print or copy them somewhere safe (see below). That's it, you're protected.
Tip: Passkeys on an iPhone or Mac sync through your Apple account, and on Android through your Google account, so they also work on your other devices signed in to the same account. On a work computer or a PC, add a passkey there too.
How to set up an authenticator app
- 1
Install a free authenticator app
Search the App Store (iPhone) or Google Play (Android) for Google Authenticator, Microsoft Authenticator or Authy, and install one.
- 2
Start set-up in Shopstar
Go to Sign-in security and choose Use an authenticator app. Keep this page open on your computer.
- 3
Scan the QR code
In the app, tap + or Add account, then Scan a QR code, and point your phone's camera at the code on your screen. Can't scan? Choose Enter a setup key instead and type in the key Shopstar shows you.
- 4
Type in the 6-digit code
The app now shows a Shopstar entry with a code that changes every 30 seconds. Type the current code into Shopstar and click Turn on two-step sign-in.
- 5
Save your recovery codes
Download, print or copy your 10 backup codes and keep them somewhere safe.
Tip: If a code is rejected, check your phone's date and time are set automatically (in your phone's settings), then try the newest code.
Recovery codes: your spare key
When you turn on 2FA, Shopstar gives you 10 recovery codes. If you ever lose your phone or can't use your passkey, any one of them gets you in. Each code works only once.
- Keep them in a password manager, or print them and store them somewhere safe at home.
- Don't keep them only on the same phone you use for 2FA.
- Running low, or think someone has seen them? Make a fresh set in Sign-in security. The old ones stop working straight away.
Lost your phone or got a new one?
- 1
Sign in with a recovery code
On the "Confirm it's you" screen, choose Lost your phone? Use a recovery code.
- 2
Remove the old method
In Sign-in security, remove the passkey or authenticator app from the lost phone.
- 3
Set it up again
Add a passkey or authenticator app on your new phone, and save your new recovery codes.
No recovery codes either? Email support@shopstar.co.za from the address on your account. Our team will check it's really you and help you get back in.
Questions people ask
Does 2FA cost anything?
No. Two-step sign-in is free on every Shopstar plan, and the authenticator apps are free too.
Do I need a smartphone?
Not for passkeys: most computers made in the last few years can create one with Windows Hello or Touch ID. The authenticator app option needs a smartphone.
Will I need a code every time I open Shopstar?
No. You're only asked when you sign in. If you tick "Remember me", you'll stay signed in on that device.
Can each person on my team have their own?
Yes, and they should. Everyone who signs in to your shop sets up two-step sign-in on their own login. Never share codes or passkeys.
Will Shopstar ever ask me for my code?
Never. We'll never ask for a code, recovery code or password by phone, email or WhatsApp. Only type them into the Shopstar sign-in page.
Is it required?
From 1 December 2026, two-step sign-in will be required for all Shopstar accounts. Until then it's optional, but we strongly recommend turning it on now.
Last updated 8 November 2026.