Shopify's two-step code belongs to a person, not to your store

What Shopify publishes about number type

Nothing. Shopify's SMS page and its login-troubleshooting page never mention VoIP, virtual numbers or landlines. There is no published rule to satisfy and none to point at if a code does not arrive. What each service publishes about VoIP collects the handful of companies that do print one, and Shopify is not among them.

What Shopify does say is that SMS is its weakest option: “The other methods of two-step authentication provide greater security for your account”, and “Consider only using SMS text messages as form of two-step authentication if you have no other method available to you” (Shopify). The alternatives it lists are an authenticator app, a security key and a built-in authenticator (Shopify).

Passkeys are a separate thing on Shopify, and it is worth knowing which is which: “A passkey replaces your password. It isn't a two-step authentication method, and the two are set up and removed separately” (Shopify).

The part that surprises store owners

• Shopify Help Center, on staff two-step authentication

  “Two-step authentication is tied to a staff member's individual Shopify ID, not to your store.”

  https://help.shopify.com/en/manual/your-account/users/security/two-step-authentication

• Shopify Help Center, on what an owner can and cannot do

  “you can require or not require two-step authentication for a staff member, but you can't view or change the phone number, authentication app, or recovery codes”

  https://help.shopify.com/en/manual/your-account/users/security/two-step-authentication

And from the other direction: “Staff members can set up two-step authentication for their own individual accounts. The store owner can't activate two-step authentication for any other staff member” (Shopify).

So there is no shared-number model for staff, and you should not try to build one. Each person signs in as themselves. What is left, and what actually goes wrong, is the *owner* account: one Shopify ID that holds the store, whose number is usually a personal cell belonging to whoever opened it.

Adding or changing the number

Shopify's own path for turning on SMS (Shopify):

1. 01From your Shopify admin, click your store name.
2. 02Click your profile, then click Security.
3. 03In the Two-step authentication section, click Turn on two-step, and enter your password.
4. 04From the Authentication method list, select SMS delivery.
5. 05Select a country code, enter the number, and click Send authentication code.
6. 06Enter the six-digit code and click Turn on.

Changing the number is a remove-and-re-add, and Shopify warns you what that costs: “Updating your phone number requires removing your current SMS method, so you'll be prompted to complete a two-step authentication challenge.” In practice that means you need the old number working while you switch. Useful detail on the same page: “You can add one or more different phone numbers as a backup authentication method” (Shopify). Add the new line as a backup *before* you retire the old one, and the switch stops being a cliff edge.

If you lose the number

Shopify lays out three steps in order. Use another method — “you can use an alternative method such as a passkey or authenticator app”. Failing that, and if your account does not require a secure sign-in method, “you can deactivate two-step authentication to regain access”. If it does require one: “you can recover your account by verifying your identity. Your request is reviewed before access is restored” (Shopify).

Recovery codes are worth generating and storing off the phone. Shopify's note on them: they are “12 digits instead of the 6-digit code, but work in the same way” (Shopify).

Where a Cleat line fits

On the owner's Shopify ID, when the number that receives the code should outlive a SIM: the merchant has moved abroad and the US mobile is gone; the store is a company asset and the login should not depend on a founder's personal handset; or an ops team needs to see that a challenge arrived. A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person, with a shared inbox the team can read. $24.99 a month, receive-only. For an agency running a client's store, the clean model is on Cleat for teams: the client owns the line and invites you, and your access ends when the engagement does.

When Cleat is the wrong answer here

• You want your staff to share one login. Shopify ties two-step to each person's own Shopify ID for a reason, and staff accounts cost nothing.
• An authenticator app or a security key will do. Shopify says plainly to use SMS only when you have nothing else.
• You want a second store to get around an account restriction. One verified person per Cleat line, and using it that way breaks Shopify's terms and ours.
• You need to send anything. The line receives texts and transcripts of incoming calls. It cannot text back, cannot dial out, and cannot reach 911.

Keep reading

Etsy · Walmart Marketplace · Stripe · Every service in this section