> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shoppex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> 2FA, active sessions, and the audit trail.

Shoppex authentication runs on BetterAuth, with two-factor authentication, session
management, and an audit trail for every shop.

<Note>
  Manage your 2FA and sessions from your **profile** (avatar dropdown, top right, then
  **Profile**, or go to `/settings/me/profile`). The shop-level audit trail is under
  **Security** in the sidebar.
</Note>

## Two-factor authentication

Open your profile page. Shoppex supports time-based one-time passwords (TOTP) through any
authenticator app, for example Google Authenticator, Authy, 1Password, Bitwarden, or any app
that scans a QR code.

When you enable 2FA, you scan the QR code with your app and enter a code to confirm, and you
are done. Future logins from new devices prompt for the code.

At enrollment, Shoppex gives you a set of **recovery codes**. Save them somewhere safe. If you
lose your phone, they are the only way back into your account.

## Active sessions

The session list on your profile page shows every device currently logged in. Revoke an
individual session or sign out everywhere at once. This is useful after a lost device, or when
you have been working on someone else's machine.

## Audit trail

Every significant action by every teammate is recorded under **Security → Audit Trail**
(`/security/audit`). Each entry captures:

* Who acted (user ID).
* What they did (action name, resource type, resource ID).
* When (timestamp).
* From where (IP and user agent).
* What changed (before/after data for updates).

Filter by user, action type, or date range. The log is kept indefinitely.

## Account recovery

If you lose access to both your password and your 2FA device, identity verification can
recover the account. Reach out through the [Shoppex Discord](https://discord.gg/VjrptT6Nvx) or
[Telegram](https://t.me/shoppexhq). The team will verify your ownership and walk you through
the recovery flow.