Secure User Authentication

Virto Commerce lets a store offer more than a password. Customers can sign in with an emailed code or a passkey, and a store can require a second sign-in step.

An administrator turns one-time codes and passkeys on or off per store, and every sign-in is recorded in the sign-in log.

• Password and SSO: Customers and administrators sign in with a username and password, or through single sign-on with Microsoft Entra ID (Azure AD) or Google.
• One-time code sign-in: A returning customer signs in with a code emailed to them instead of a password. An administrator turns this on or off per store in the store settings.
• Multi-factor sign-in with an emailed code: A password sign-in can be followed by a one-time code sent by email as a second step, for both the storefront and the Backoffice. For the Backoffice, that means the admin panel is protected by more than a password.

A shopper registers a passkey on their device: Face ID, Touch ID, Windows Hello, Android, or a FIDO2 security key. The passkey is bound to your website, and the private key never leaves the device. A fake login page cannot capture it, and it cannot be replayed on another site.

• One tap with browser autofill: Shoppers sign in with a passkey instead of a password, including one-tap sign-in through the browser’s autofill on the login field.
• No second step needed: A verified passkey satisfies the second factor on its own, so the code step is skipped.
• Managed by the shopper: Under Account, then Security, shoppers add, rename, and delete their own passkeys, each showing its last-used date.
• On by default, controlled per store: Passkey sign-in is on for every store and for the Backoffice. A store administrator can turn it off per store, and separately for the Backoffice.
• Logged like any sign-in: Every passkey sign-in is recorded, and failed attempts count toward the account lockout threshold.

• Fewer password resets reaching support: Customers who sign in with a code or a passkey have no password to forget.
• A phishing route closed: A passkey cannot be typed into a fake login page, so that route to stolen credentials is closed instead of watched.
• A record a reviewer can check: Every sign-in lands in the sign-in log, so the controls above leave evidence.

• A returning buyer signs in with an emailed code instead of resetting a forgotten password.
• A security team asks whether the admin panel is protected by more than a password, and the answer is a one-time code as a second step.
• A shopper registers a passkey once and signs in with one tap from then on.
• An administrator reviews failed attempts in the sign-in log, where each failed passkey attempt counts toward the lockout threshold.

Sign-in methods are set up in the admin panel and described step by step in the user guide.