Security, 2FA & Passkeys

Protect the account that owns your store with a password, two-factor authentication and passkeys.

Your account is the key to your store. If it is compromised, someone can change your products, issue refunds, create API keys and, if you are the owner, reach your payout settings.

Dashboard → your account menu → Security. No permission needed; these are your own settings.

What to set up, in order

1. A unique password

Not one you use anywhere else. A reused password that turns up in someone else's breach gets tried against every service you might hold, including this one.

2. Two-factor authentication

With 2FA on, a stolen password alone is not enough to sign in. Add 2FA Method offers two choices: Authenticator app and Security key (FIDO2). Each method you add gets a name, which you can change later with Rename 2FA method.

If you own a store, treat 2FA as mandatory. You are running a business that takes card payments and holds customer records. An account takeover can mean fraudulent refunds, a drained balance and a compromised customer list.

3. A passkey

PayNow supports passkeys (WebAuthn). You add one from the Two-Factor Authentication card with Add 2FA Method → Security key (FIDO2), and give it a name so you can recognise it later. It is a second factor rather than a replacement for your password: you still sign in with your email and password, and the passkey stands in for an authenticator code. A passkey is bound to the real site, so a convincing fake login page cannot capture anything usable. Passwords and authenticator codes can.

4. Store your recovery codes somewhere safe

Enabling 2FA gives you ten recovery codes. They are how you get back in if you lose your device, and removing a 2FA method asks for one.

Each code works once. Ten codes means ten uses, so treat them as a finite supply rather than a password you can keep re-entering.

Save recovery codes outside the device that generates your codes. Storing them only on the phone running your authenticator means losing the phone locks you out of both at once. A password manager works, or printed and kept somewhere physically safe. Do not put them in a Discord DM to yourself.

Common threats

Threat	What it looks like	What stops it
Credential stuffing	Your reused password, from someone else's breach	A unique password
Phishing	A fake PayNow login page, usually linked from Discord	Passkeys; checking the domain
Fake support	Someone claiming to be PayNow staff asking for a code	Never share codes. No PayNow employee will ever ask for your password, a 2FA code or a recovery code, whatever their Discord name says.
Session theft	Malware on your machine	2FA, and changing your password with Log me out of other devices ticked

For teams

Your security is only as good as the weakest account with access to your store. Require 2FA of anyone you invite as a team member, give the narrowest role that works, and remove people the day they leave. Reset any API keys they had access to: removing someone from the team does not invalidate a key they already copied.

If you think you have been compromised

Work down this list in order.

1. Change your password.

2. Enable or re-enrol 2FA, and remove any device you do not recognise.

3. Reset every API key.

4. Check Team Members for accounts you did not add.

5. Check Roles for permissions you did not grant.

6. Check Payouts for changed payout details or unexpected withdrawals. People forget this step, and it is where the money is.

7. Email [e-mail] from your own address, describing what you found.