Sign in with Customer TFA

The customer first submits the normal Magento email and password. Magento keeps the customer signed out while it waits for TFA verification. A valid authenticator code completes the session and returns the customer to the original same-store destination when that URL is safe.

The same challenge is used after Magento's regular login form and AJAX login.

Use an authenticator code

Enter the current six-digit code from the enrolled authenticator. Codes are time based, so the phone and Magento server need accurate clocks.

After the configured number of invalid attempts, the pending login is cancelled. Start again with email and password.

Use a recovery code

On the verification page, select Use recovery code instead and enter one saved recovery code. The code is removed as soon as it successfully completes a login and cannot be reused.

Magento shows a notice asking the customer to generate a new set. The customer can continue using the remaining codes, but replacing the set is safer when one was needed because the authenticator was lost.

Regenerate recovery codes

From the customer dashboard, use Regenerate Recovery Codes and provide the credential selected by the store configuration: either a current authenticator code or the current Magento password.

The new codes replace every old code. Save them from the one-time success page before leaving it.

Disable optional TFA

When TFA is not mandatory, the customer dashboard offers Disable TFA. The current Magento customer password is required. Disabling removes the stored authenticator secret and recovery codes.

When TFA is mandatory, this action is not offered and the service rejects disablement.