Sign in with Customer TFA

The customer first submits the normal Magento email and password. Magento keeps the customer signed out while it waits for TFA verification. A valid authenticator code completes the session and returns the customer to the original same-store destination when that URL is safe.

The same challenge is used after Magento's regular login form and AJAX login.

Use an authenticator code

Enter the current six-digit code from the enrolled authenticator. Codes are time based, so the phone and Magento server need accurate clocks.

After the configured number of invalid attempts, the pending login is cancelled. Start again with email and password.

Use a recovery code

On the verification page, select Use recovery code instead and enter one saved recovery code. The code is removed as soon as it successfully completes a login and cannot be reused.

Magento shows a notice asking the customer to generate a new set. The customer can continue using the remaining codes, but replacing the set is safer when one was needed because the authenticator was lost.

Regenerate recovery codes

When the store allows customer regeneration, use Regenerate Recovery Codes from the customer dashboard and provide the configured credential: either a current authenticator code or the current Magento password.

The new codes replace every old code. Save them from the one-time success page before leaving it.

If the block is not visible, customer regeneration is disabled for the current store scope. An administrator can still reset TFA from the customer record when the support process calls for a full enrollment reset.

Disable optional TFA

When TFA is not mandatory, the customer dashboard offers Disable TFA. The current Magento customer password is required. Disabling removes the stored authenticator secret and recovery codes.

The block appears only when the store allows customer disablement. When TFA is mandatory, the action is not offered and the service rejects disablement. Magento checks both rules again when the form is submitted.

Custom login implementations

The inline challenge attaches to Magento's customer_account_loginpost and customer_ajax_login actions. A custom login endpoint of your own does not trigger the challenge inline — the storefront-wide guard redirects the customer to setup or verification on the next page instead.

For a theme or popup that uses the standard customer_ajax_login action, the contract is:

• The JSON request body may include tfa_return_url, a same-origin destination the customer lands on after verification. Unsafe or off-site values are discarded.
• When a pending challenge exists, the response is {errors: false, message, redirectUrl} with redirectUrl pointing to customer_tfa/account/tfaverify — or customer_tfa/account/tfasetup during mandatory enrollment — instead of the normal post-login target.