Authenticator Locking Me out

Technical Q&A

Topic summary

Main issue: Authenticator app codes fail, leaving the user locked out while Two-Step Authentication (2SA) remains active.

Recent developments:

  • Support escalation verified the user’s identity and reported 2SA is turned off. Despite this, 2SA still blocks access.
  • The user has exhausted all recovery codes attempting workarounds.
  • Ongoing attempts to reach support via email receive no human response; no phone contact has been established.

Key terms:

  • 2SA: Two-Step Authentication, an added login security layer requiring a time-based code.
  • Authenticator app: Mobile app that generates time-based verification codes.
  • Recovery codes: One-time backup codes used when the authenticator is unavailable.

Outcomes and status:

  • No resolution; the account remains inaccessible.
  • Open issue: Why 2SA is still active despite support claiming it was disabled, and lack of support follow-up.
Summarized with AI on December 15. AI used: gpt-5.
1

I have my email in the authenticator app on my phone and the codes are not working.

I have contacted support and my identity has been verified by the escalation team, and they say it is off, but 2SA remains active and we are still locked out with no working access through the authenticator app.

I keep emailing them back, but I get no response from a human or any phone contact to discuss issue to get back up and running.

I have used all my recovery codes just trying to find a workaround for this since they are not replying.

2

Hello @service_383!

Unfortunately, there’s no way to bypass the authenticator without Shopify Support if you’re fully locked out.

What you can do first is check if you still have access to the original device where the authenticator was set up. If you do, make sure the device’s date and time are set to automatic, since an incorrect time can cause the codes to fail. You can also try using any backup recovery codes you saved when 2FA was first enabled.

Hope this helps! Feel free to share an update here if you figure out the exact cause or find a solution that works for you.

If you’re still locked out, Shopify Support should be able to sort it out once identity verification is completed.

3

If Shopify Support has verified identity and confirmed that 2SA was disabled, yet the login flow still prompts for authenticator codes, this means:

  1. 2SA is still enforced at the account or staff-user level

    • Shopify 2SA can remain active on:

      • The store owner account

      • A specific staff account

      • A Shopify ID linked to multiple stores

    • Disabling 2SA on one level does not automatically remove it everywhere.

  2. Authenticator desynchronization

    • Authenticator apps rely on time-based tokens.

    • If the device clock was ever out of sync or the authenticator was reinstalled, generated codes will fail permanently.

    • Once recovery codes are exhausted, only Shopify Support can reset 2SA.

  3. Partial or failed 2SA removal

    • In rare cases, support disables 2SA on the admin interface, but the authentication service does not fully propagate the change.

    • This results in Shopify still requesting a code even though 2SA shows as “off” internally.

Why Access Is Still Blocked

  • All recovery codes are used

  • Authenticator codes are invalid

  • 2SA enforcement remains active

  • Therefore, the account is locked by design — there is no self-service workaround.

4

The challenge is trying to get them to response to my situation that I have been trying to reach them since they sent the email last week saying it was disabled. It is really unreasonable for a business this large being an important asset to online businesses would not have a phone contact.

5

I would hope they would have someone monitoring this forum

6

No. This is peer-to-peer community.