> For the complete documentation index, see [llms.txt](https://guides.paynow.gg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://guides.paynow.gg/your-account/security.md).

# Security, 2FA & Passkeys

Your account is the key to your store. If it is compromised, someone can change your products, issue refunds, create API keys and, if you are the owner, reach your payout settings.

*Dashboard → your account menu → Security. No permission needed; these are your own settings.*

<figure><img src="/files/vM5O0sgl4iEVtT6UOUgP" alt="The account Security page showing password, two-factor authentication and passkey options."><figcaption></figcaption></figure>

## What to set up, in order

### 1. A unique password

Not one you use anywhere else. A reused password that turns up in someone else's breach gets tried against every service you might hold, including this one.

### 2. Two-factor authentication

With 2FA on, a stolen password alone is not enough to sign in. **Add 2FA Method** offers two choices: **Authenticator app** and **Security key (FIDO2)**. Each method you add gets a name, which you can change later with **Rename 2FA method**.

{% hint style="danger" %}
**If you own a store, treat 2FA as mandatory.** You are running a business that takes card payments and holds customer records. An account takeover can mean fraudulent refunds, a drained balance and a compromised customer list.
{% endhint %}

### 3. A passkey

PayNow supports passkeys (WebAuthn). You add one from the Two-Factor Authentication card with **Add 2FA Method → Security key (FIDO2)**, and give it a name so you can recognise it later. It is a second factor rather than a replacement for your password: you still sign in with your email and password, and the passkey stands in for an authenticator code. A passkey is bound to the real site, so a convincing fake login page cannot capture anything usable. Passwords and authenticator codes can.

### 4. Store your recovery codes somewhere safe

Enabling 2FA gives you **ten recovery codes**. They are how you get back in if you lose your device, and removing a 2FA method asks for one.

**Each code works once.** Ten codes means ten uses, so treat them as a finite supply rather than a password you can keep re-entering.

{% hint style="warning" %}
**Save recovery codes outside the device that generates your codes.** Storing them only on the phone running your authenticator means losing the phone locks you out of both at once. A password manager works, or printed and kept somewhere physically safe. Do not put them in a Discord DM to yourself.
{% endhint %}

## Common threats

| Threat                  | What it looks like                                    | What stops it                                                                                                                               |
| ----------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **Credential stuffing** | Your reused password, from someone else's breach      | A unique password                                                                                                                           |
| **Phishing**            | A fake PayNow login page, usually linked from Discord | Passkeys; checking the domain                                                                                                               |
| **Fake support**        | Someone claiming to be PayNow staff asking for a code | Never share codes. **No PayNow employee will ever ask for your password, a 2FA code or a recovery code**, whatever their Discord name says. |
| **Session theft**       | Malware on your machine                               | 2FA, and changing your password with **Log me out of other devices** ticked                                                                 |

## For teams

Your security is only as good as the weakest account with access to your store. Require 2FA of anyone you invite as a [team member](/store-settings/team-members.md), give the narrowest [role](/store-settings/roles.md) that works, and remove people the day they leave. Reset any [API keys](/integrations-and-commands/api-keys.md) they had access to: removing someone from the team does not invalidate a key they already copied.

## If you think you have been compromised

Work down this list in order.

1. **Change your password.**
2. **Enable or re-enrol 2FA**, and remove any device you do not recognise.
3. **Reset every** [**API key**](/integrations-and-commands/api-keys.md)**.**
4. **Check** [**Team Members**](/store-settings/team-members.md) for accounts you did not add.
5. **Check** [**Roles**](/store-settings/roles.md) for permissions you did not grant.
6. **Check** [**Payouts**](/payments-and-payouts/payouts.md) for changed payout details or unexpected withdrawals. People forget this step, and it is where the money is.
7. **Email** [**support@paynow.gg**](mailto:support@paynow.gg) from your own address, describing what you found.