Managing Multi-factor Authentication (MFA) for Users

Multi-factor authentication (MFA), or two-factor authentication (2FA), is a crucial security measure that adds extra protection to your ShipHero account. By requiring users to enter a temporary code during login, MFA significantly enhances the security of your account. In this guide, we will walk you through the process of enabling MFA for your ShipHero account and managing it effectively.

Important Notes

• Multi Factor Authentication at ShipHero works in an Adaptive basis: MFA Challenges (the one-time code you enter) are exclusively requested when the user login is considered “suspicious” (e.g., the user is logging in from a new unknown device, or from a different geolocation as usual).
• A user must be an Admin or have Edit Users permissions enabled in their user's Role to be able to edit this setting for themselves and other users.  
• ShipHero does not currently support MFA via email. You must have an authenticator app on a phone to use MFA with ShipHero, i.e., Google Authenticator or Microsoft Authenticator. MFA also works with the native Passwords app from iPhone.
• MFA is be required for senstive actions such as issuing a refund and will be requested when issuing the first refund of each day. 
• API Usage with MFA: If you use a standard user to generate API tokens, enabling MFA will prevent those tokens from functioning. To continue using the standard user for API access, you can either disable MFA for that user or switch to ShipHero's third-party developer accounts for API access.

How to Enable/Disable MFA 

MFA must be enabled/disabled at the user level. You can do this one by one within the user's settings page or for multiple users at once. 

NOTE: If you disable then re-enable MFA for a user, they will need to register their device again.

Managing MFA for an Individual User

1. Go to the Users Page and open the indiviual User's Settings by clicking on their name.
2. Toggle the Multi-Factor Authenitcation Setting "On" to enable MFA and "Off" to Disable MFA.
3.  Hit Save.

Managing MFA for Multpile Users

1. Go to the Users Page and Check the users to be edited.
2. Select the Enable MFA button. 
3.  You will be prompted with "You are about to enable Multi-factor authentication. The user or users will have to download a Google Authenticator (or similar) app to log in to the platform."
4. Hit Enable. 

Registering a Device

Once MFA is enabled, users will be prompted to register their devices during the next login. The registered device is the one used as the "second source of truth," not the device you are signing into ShipHero on.  

1. Log into ShipHero with the username and password.
2. Scan the QR code with the device that will be used for MFA.
3. Enter the code from your authicator app and hit Continue.

After authenticating for the first time you will be asked to store your recovery code. Save this somewhere else to be able to use in the event that an authentication device is lost/stolen.

You must accept I have safely recorded this code to continue logging in.