Customer Two-Factor Authentication

SoftwareSilo Customer TFA adds authenticator-app verification to Magento storefront customer accounts. After the normal email and password check, an enrolled customer must enter a current six-digit authenticator code or one unused recovery code before Magento creates the signed-in session.

Customers can enroll from My Account when TFA is optional. When it is mandatory, a customer who has not enrolled is redirected to setup from every storefront page — not just account pages; only the TFA setup/verification routes and logout stay reachable until enrollment finishes. An enrolled customer whose verification is pending is likewise held on the verification page.

Included workflows

Time-based one-time password (TOTP) enrollment by QR code or manual secret.
Verification after regular and AJAX customer login.
Configurable one-time recovery codes.
Recovery-code regeneration after a current TFA code or customer password check.
Customer-initiated disablement when TFA is optional.
Magento Admin status and reset controls with a separate ACL permission.
An optional bypass for Magento's Login as Customer support workflow.

The package protects storefront customer sessions. It does not configure Magento Admin two-factor authentication, send codes by email or SMS, remember trusted devices, or add REST and GraphQL endpoints.

Start here

Configuration is under Stores > Configuration > MageB2B > Customer Two-Factor Authentication.