Customer TFA FAQ
Which authenticator apps work?
The setup uses standard TOTP provisioning. Apps that support time-based one-time passwords can scan the QR code or accept the secret manually.
Does the module send codes by email or SMS?
No. It supports authenticator-app codes and one-time recovery codes.
Is TFA optional or mandatory?
The store administrator chooses. Optional mode lets each customer enroll and later disable TFA with the current password. Mandatory mode requires setup and prevents customer disablement.
When is the customer considered signed in?
For an enrolled account, only after the password and TFA challenge both succeed. Magento keeps the password result pending until verification.
How many recovery codes are created?
The count is configurable and defaults to 10. Each generated code has ten uppercase letters or digits and works once.
Can recovery codes be viewed later?
No. Their values appear only on the success page immediately after setup or regeneration. The dashboard shows only the remaining count.
What invalidates old recovery codes?
Using a code removes that code. Regenerating the set invalidates every previous recovery code. Disabling or resetting TFA removes the set as well.
What happens after too many wrong codes?
Magento cancels the pending TFA login and returns the customer to normal sign-in. It does not permanently lock the account through this feature.
Can an administrator see the secret or recovery codes?
The customer form shows only whether TFA is enabled. The secret and recovery-code list are stored encrypted and are not displayed by the Admin UI.
Can an administrator reset TFA?
Yes, with the dedicated ACL permission. Reset clears the customer's TFA state. Your support team should verify account ownership first.
Does Login as Customer require TFA?
That depends on configuration. The default bypass allows the assisted Admin session without customer TFA. Disable the bypass to challenge impersonated sessions too.
Does the module remember trusted devices?
No. A new customer login session requires a fresh authenticator or recovery code.
Does it protect Magento Admin users?
No. It protects storefront customer accounts. Magento Admin authentication is a separate system.
Is there a REST or GraphQL API?
No. The package provides storefront and Admin UI flows and declares no web API or GraphQL schema.