Signing in and two-step

Most days you'll open VendorDue from Apps in your Shopify admin, and there's nothing to sign in to: Shopify has already told VendorDue who you are. Signing in only matters when you want VendorDue in a tab of its own, or on a phone without the Shopify app.

Inside Shopify, VendorDue's pages are in Shopify's own menu under VendorDue, with Settings last. A bar across the top holds search, what you owe, the bell and the light or dark switch. In a tab of its own, VendorDue has its own sidebar instead.

Use VendorDue outside Shopify#

In Settings › , then Security, add a way to sign in. Until you do, it reads No sign-in method outside Shopify: "Add a passkey or set a password to open VendorDue in its own tab."

• Passkey: your fingerprint, face or device lock instead of a password. Press Add passkey. Shopify doesn't allow passkeys to be made inside it, so VendorDue offers Continue in a new tab first.
• Password: press Set password. Once you have a passkey, a password is "Optional when you have a passkey."

Then sign in at vendordue.com with your email address.

Inside Shopify, the bar across the top has Open VendorDue. One press opens VendorDue in a new tab, already signed in, on the page you were on. On a phone, where the Shopify app has no bar across the top, it sits at the top of Settings › , then Account.

That tab stays signed in for a week. Until you have a passkey or a password, a line at the top of it offers Set a password, which opens Settings › , then Security with the password row lit and ready. Once it's saved, VendorDue reminds you where to use it: "Sign in at vendordue.com with" your email. The cross beside the line hides it for good.

Two-step sign-in#

Set up an Authenticator app with Set up, and VendorDue asks for its six-digit code after your password: "Scan the code with Google Authenticator, 1Password or any app that shows six digits." A stolen password alone then can't open your store's records.

"A passkey sign-in counts as both steps", so with a passkey there's no code to type.

When you enter a code on a computer you use often, tick Trust this device for 30 days, and it won't ask there again until then. Trusted devices are listed under Two-step authentication, each with "Skips two-step until" a date, and Remove beside it.

An Admin can make two-step required for the whole team with Require two-step authentication in Settings › , then Team. Then anyone without an authenticator app sets one up the next time they sign in outside Shopify. It stays on while PayPal is connected. See Before money moves.

Devices#

Devices lists every browser signed in to your account outside Shopify. Press Sign out beside any you don't recognise, or Sign out all other devices.

Changing your password, or removing a passkey or your authenticator app, signs out every other device. Adding one doesn't.

When it looks wrong#

I forgot my password#

On the sign-in page, press Forgot password?. "We sent six digits to your inbox. You choose a new password next." Nobody at VendorDue can see or set your password for you.

It keeps asking me to sign in#

It's been more than 14 days since you opened VendorDue inside Shopify. Open it once from Apps in your Shopify admin, then sign in outside Shopify again.

My authenticator app was on a phone I lost#

Sign in with a passkey if you have one. If not, open VendorDue inside Shopify. Shopify's own sign-in already proved it's you, so in Settings › , then Security you can Remove the old authenticator and Set up a new one. There are no backup codes to keep.

"Passkeys can't be created inside Shopify"#

That's Shopify's rule for apps inside its admin. Press Continue in a new tab, and add the passkey there.

Common questions#

Do I need a VendorDue password at all?

No. If you only ever open VendorDue inside Shopify, you never sign in. More

Do my vendors sign in the same way?

They use the same sign-in page, and land on their own page. Your team's two-step rule never applies to them; they choose their own. See Signing in, and several stores. More

What if I'm also a vendor at another store?

One browser can be signed in on both sides. VendorDue asks Continue as: Your store, or Your payouts. More