Two-factor sign-in
Protect your account with a one-time code from an authenticator app on top of your password. How to turn it on, and how to look after your recovery codes.
With two-factor sign-in you enter a one-time code as well as your password when you sign in. The code comes from an authenticator app on your phone. Even if someone gets hold of your password, they cannot get in without your phone. We recommend it for everyone with access to the admin panel – especially the owner.
Before you start
- Install an authenticator app on your phone, for example one of the common one-time code (TOTP) apps.
- Have your password ready – you need to confirm it.
How to turn on two-factor sign-in
- Click your name in the user menu at the top right. The «Min profil» (My profile) page opens.
- Find the «Tofaktorautentisering» (Two-factor authentication) section and press «Aktiver» (Enable).
- Confirm your password and press «Fortsett» (Continue).
- Scan the QR code with your authenticator app. If you cannot scan it, type in the key shown under «Kan du ikke skanne?» (Can't scan?).
- Enter the 6-digit code from the app and press «Bekreft» (Confirm).
- You see the message «Tofaktorautentisering er aktivert» (Two-factor authentication is enabled), and your recovery codes are shown.
- Save the recovery codes somewhere safe, for example in a password manager.
Signing in afterwards
- Enter your email and password as usual.
- You are asked for a one-time code. Open your authenticator app and type the code shown.
- If you do not have your phone, you can use one of your recovery codes instead.
The code is required both in the admin panel and when you sign in to the webshop with the same account. If you sign in with Google, Vipps or a one-time SMS code, you are also asked for the code when the account has two-factor sign-in.
Managing your recovery codes
On «Min profil» under «Tofaktorautentisering» you have these options (all require your password):
| Button | What it does |
|---|---|
| «Vis gjenopprettingskoder» (Show recovery codes) | Shows your current codes. |
| «Regenerer koder» (Regenerate codes) | Creates new codes. The old ones stop working. |
| «Deaktiver» (Disable) | Turns off two-factor sign-in. Your account becomes less secure. |
The reminder to turn it on
If you have access to the admin panel without two-factor sign-in, Cmerce shows a reminder:
- a separate page, «Beskytt kontoen din» (Protect your account), with the buttons «Sett opp nå» (Set up now) and «Hopp over for nå» (Skip for now)
- a banner at the top of the admin panel
«Hopp over for nå» postpones the page for a while (usually 14 days), but the banner stays until you turn on two-factor sign-in. The reminder is not shown while the store is still in the «Kom i gang» setup wizard.
Good to know
- Two-factor sign-in is optional for store staff. Nobody is locked out for not turning it on.
- The till uses a till PIN, not a one-time code. On a paired till device, staff sign in with their kasse-PIN. The device itself is already approved.
- A code can only be used once. If a correct code is refused, it has just been used – wait for the next code in the app.
- Sign out elsewhere. Under «Nettleserøkter» (Browser sessions) on «Min profil» you can press «Logg ut andre økter» (Log out other sessions) if you think someone else is signed in with your account.
Frequently asked questions
I have lost my phone. What do I do?
Sign in with one of your recovery codes. Then turn off two-factor sign-in and set it up again with your new phone.
I have lost both my phone and my recovery codes.
Without your phone and recovery codes you cannot complete the sign-in yourself. Contact Cmerce for help.