Security settings
Security settings protects access to your dashboard and to the data you export. Open it from Settings > Security settings. The page has five cards: two-factor authentication, exported file protection, the one-time password (OTP) method, passkeys for biometric sign-in, and session management.
Turn on two-factor authentication
Two-factor authentication (2FA) asks everyone who signs in to the dashboard, the store owner and every team member, for a verification code in addition to their password. You turn it on in the Verification method card.
Go to Settings > Security settings.
In Verification method, select Two-factor authentication (2FA).
Select Save.
When the authenticator app is available for your store, selecting Two-factor authentication (2FA) also selects Via authenticator app and opens its setup. Follow Set up an authenticator app, or choose another method before you save.
To turn it off, select Single-factor authentication, select Save, then select Turn off in Turn off two-factor authentication for the whole team?. Team members then sign in with their password only, and anyone who used an authenticator app goes back to codes by email or SMS. Zid emails them about the change.
Only the store owner can turn two-factor authentication on or off. Team members see the choice, but it is locked for them.
Protect exported files with a password
When this option is on, every file you export from the dashboard (orders, products, customers and so on) is locked with a password that Zid creates automatically and sends to your registered email.
Find Protect exported files with a password.
Turn the switch on. Turn it off to export files without a password.
To open a protected file, download it from Export requests and enter the password from the email.
The switch saves as soon as you change it. Your exported files are listed in Export requests, which also has a Security settings button that brings you back here.
Choose how you receive verification codes
Under Choose your preferred verification method in the Verification method card, you choose where your own sign-in codes come from. Each team member chooses for their own account.
Select your phone, Via email or Via authenticator app.
Select Save.
The phone option depends on your account's phone number: codes go Via SMS to a Saudi number and Via WhatsApp to any other number, and the option is labeled accordingly. To change the number, see Account settings.
Via authenticator app appears only while two-factor authentication is on and the authenticator app is available for your store. When you move from the authenticator app to another method, Zid asks you to confirm it's you before it saves.
Set up an authenticator app
An authenticator app on your phone creates the verification code itself, so you don't wait for an SMS or email. You can use any authenticator app that scans a QR code.
In Verification method, with Two-factor authentication (2FA) selected, select Via authenticator app.
In Confirm it's you, enter your password and select Confirm. To get a code instead, select Email me a code instead and enter the 4-digit code from the email.
In Connect authenticator app, scan the QR code with your authenticator app. If you can't scan it, select Copy next to Setup key and add the key to the app manually.
Enter the 6-digit code the app shows in Verification code, then select Verify.
In Your backup codes, select Copy or Download, then select I've saved them.
Zid shows your backup codes only once. Keep them somewhere safe: each code signs you in once if you lose your phone.
From your next sign-in, Zid asks for the code from the app after your password, on the Two-step verification page. If you don't have your phone, select Use a backup code there and enter one of your backup codes.
Manage your authenticator app
When your authenticator app is on, the Verification method card shows when you turned it on and how many backup codes you have left. It warns you when you are running low.
| Button | What it does |
|---|---|
| Generate new backup codes | Creates a new set of backup codes and shows them once |
| Set up on a new phone | Opens the setup again so you can connect the app on another phone, then shows a new set of backup codes |
| Remove authenticator | Turns the app off for your account after you confirm in Remove the authenticator app?. Sign-ins no longer ask for a code from the app, and your backup codes stop working |
Zid asks you to confirm it's you, with your password or an emailed code, before each of these changes.
Skip the code on trusted devices
Trusted devices lets anyone who signs in with an authenticator app skip the code on a browser they trust for 30 days. It appears in the Verification method card once your authenticator app is on.
Turn on the Trusted devices switch. It applies to the whole team and saves as soon as you change it.
On your next sign-in, select Remember this device for 30 days on the Two-step verification page before you select Verify.
The card lists the browsers you trust, each with the date you trusted it. Select Remove next to a browser to make it ask for the code again, or Remove all devices to remove every one at once.
Only the store owner can turn Trusted devices on or off. While it is off, team members don't see it and can't remember a device.
Sign in with biometrics
Passkeys and biometrics lets you sign in with your fingerprint, face or screen lock instead of a verification code. A passkey belongs to your own account, and each team member adds their own.
In Passkeys and biometrics, select Add passkey.
Confirm with your fingerprint, face or screen lock when your device asks.
The card lists your passkeys, each with its name, the date it was added and when it was last used. Next time you sign in on that device, the Sign in with biometrics page opens after your email; see Sign in with biometrics.
Add passkey is disabled when the browser or device doesn't support biometric sign-in, and the card says so. Open the page from a browser that supports it, on the device you want to sign in with.
To delete a passkey, select its delete icon, then select Delete in Delete this passkey?. You can't sign in with it any more, but you can always sign in with a verification code.
Set how long idle sessions last
Session management decides when idle team members are signed out of the dashboard. It applies to every member of your store.
| Level | What happens |
|---|---|
| Low | Any idle member is signed out after 7 days |
| Normal | Any idle member is signed out after 24 hours |
| Moderate | Any idle member is signed out after 2 hours |
| High | Any idle member is signed out after 30 minutes and can sign in from only one browser at a time |
Choose a level.
Click Save in the Session management card.
Sign out from all devices
Use this when you suspect someone else has access to your account, or after you lose a device.
In Session management, click Sign out from all devices.
Confirm the message.
Every device signed in to your account is signed out, including the one you are using, and the page reloads so you can sign in again.
Signing out from all devices can disconnect Zapier and any existing API integrations. Check your integrations afterwards and reconnect them if needed. See API integrations.
Session management is available to the store owner and to team members with the sign-out permission. Others see a permission message in the card.
Related
Still need help?
Our customer service team is ready to help, or find quick answers in the FAQ.