Follow the steps below to add MFA to your BigCommerce storefront. The storefront script installs itself. The only manual work is two small theme file changes, and any BigCommerce developer can do those for you if you would rather not.
Before you start
Make sure you have the following in place before installing.
Installation
Find Simple MFA in the BigCommerce App Marketplace and click Install. You'll be redirected through BigCommerce's OAuth flow, which grants Simple MFA the permissions it needs to create customer login sessions. No API keys or manual configuration required.
Permissions requested: read customer accounts, read store information, issue customer login tokens.
After installing, you'll be taken to the Simple MFA admin panel inside BigCommerce. A short setup checklist walks you through:
To fully secure your storefront, the native BigCommerce login page needs to be replaced. Without this change, a customer who navigates directly to /login/ could bypass Simple MFA entirely.
In the Simple MFA admin panel, find the Secure login page card and copy the replacement content it generates for your store. In BigCommerce, go to Storefront → My Themes, choose your active theme, click Advanced → Edit Theme Files, open templates/pages/auth/login.html, replace all of its content with the snippet, and save.
One more theme file needs a single line. In the same theme editor, open templates/layout/base.html and paste the line shown in the Simple MFA admin panel anywhere inside the <head> tag, then save.
This makes the signed-in customer's ID available to the script without an extra API call. The admin panel confirms this step automatically the next time a customer signs in.
Open your storefront in a private/incognito browser window and click the account login link. You should be redirected to the Simple MFA login page instead of the standard BigCommerce login.
Enter the email address of your test customer. You'll receive a magic link email. Click it to set a password and complete the account claim. Then test logging in with that password, and optionally enrol in TOTP MFA.
Simple MFA is now live for all customers on your storefront. The account claim flow is automatic and self-service, so customers are guided through setting their password on their first login.
Optionally, send your customers a heads-up email explaining that your login process has been upgraded for their security. This reduces confusion and support requests when they encounter the new login page for the first time.
Troubleshooting
Open the Simple MFA admin panel and check the Storefront script card. If it does not show Installed, click Re-register to reinstall the script on your storefront.
If it does show as installed, clear your browser cache and try again in a fresh private window. Also confirm your theme's login.html still contains the replacement content, since theme updates overwrite edited files.
Check the spam/junk folder first. If it's not there, verify that the email address exists as a customer in your BigCommerce admin. If the problem persists, contact hello@simplemfa.app.
This usually means the store_v2_customers_login permission scope is missing from the app installation. Try uninstalling and reinstalling Simple MFA from the BigCommerce App Marketplace to re-trigger the OAuth flow with the correct scopes.
Email hello@simplemfa.app or use the support form and we'll get back to you.
Simple MFA is live on the BigCommerce App Marketplace. Free for up to 200 customer accounts.
No card required. Upgrade only when you outgrow the free tier.