Account & Security

Q: How do staff sign in to CIQRA?

Through a secure two-step flow — your password plus a two-step (2FA) verification code — entered on a dedicated CIQRA identity page, never on the store itself. Keeping credentials on one identity page is what keeps your admin protected. Note that sign-in itself is not recorded on the merchant admin — see Transparency for what is.

Q: What if I lose my two-step (2FA) device?

For security, 2FA codes can't be bypassed. Recover access through your workspace owner or by contacting CIQRA support, who can help restore your sign-in. A password reset alone won't resolve a lost 2FA device.

Q: How do I control what my team can access?

With roles and permissions. Permissions are scoped to areas of the product — catalog, orders, customers, analytics, CMS and settings — so you grant each teammate a role that fits their job and nothing more.

Q: Can I give someone access to just orders?

Yes. Because permissions are scoped by area, you can grant order-related capabilities without also granting the ability to change settings or edit your catalog. Grant the narrowest role that lets someone do their job.

Q: What is a session?

A session is an active sign-in tied to your account — what keeps you signed in after you complete the two-step sign-in. Sessions are managed, which is part of how CIQRA keeps access under control.

Q: Is admin access logged?

Partly, and the honest answer is worth the extra sentence. Actions that CHANGE something are recorded and can be attributed to an individual account — which is the reason to give each teammate their own sign-in rather than sharing one. Sign-in and sign-out on the merchant admin are NOT recorded, and neither are reads: "who looked at this" is not a question the trail can answer today. See Transparency → Sign-in protection & audit for the measured detail.

Q: Is there a central Settings screen?

Yes — Settings covers billing, domains, languages, notifications, roles, payments, shipping and more. It is not yet written up click-by-click in this section, which is a documentation gap rather than a missing feature.

This section is about who can get into your store and how securely they do it — your own account, the people on your team, and the protections around signing in. Staff sign in with a two-step (password + 2FA) flow, access is controlled by roles and permissions, and sessions are managed. Changes are recorded to an individual account; sign-in itself is not — see Transparency.

Sign-in & securityThe secure two-step sign-in, keeping your account safe, and recovering a lost 2FA device.

Staff roles & permissionsHow scoped roles and permissions gate what each teammate can see and do.

Your account & sessionsYour profile, active sessions, and exactly which activity is recorded — including what is not.

Frequently asked questions

Through a secure two-step flow — your password plus a two-step (2FA) verification code — entered on a dedicated CIQRA identity page, never on the store itself. Keeping credentials on one identity page is what keeps your admin protected. See Sign-in & security, and what is and is not recorded.

What if I lose my two-step (2FA) device?

For security, 2FA codes can’t be bypassed. Recover access through your workspace owner or by contacting CIQRA support, who can help restore your sign-in. A password reset alone won’t resolve a lost 2FA device.

How do I control what my team can access?

With roles and permissions. Permissions are scoped to areas of the product — catalog, orders, customers, analytics, CMS and settings — so you grant each teammate a role that fits their job and nothing more. See Staff roles & permissions.

Can I give someone access to just orders?

Yes. Because permissions are scoped by area, you can grant order-related capabilities without also granting the ability to change settings or edit your catalog. Grant the narrowest role that lets someone do their job.

What is a session?

A session is an active sign-in tied to your account — what keeps you signed in after you complete the two-step sign-in. Sessions are managed, which is part of how CIQRA keeps access under control. See Your account & sessions.

Is admin access logged?

Partly, and the honest answer is worth an extra sentence.

Actions that change something are recorded and can be attributed to an individual account — which is the reason to give each teammate their own sign-in rather than sharing one.

Sign-in and sign-out on the merchant admin are not recorded, and neither are reads: “who looked at this” is not a question the trail can answer today. CIQRA’s own operator console is audited in full, which is a different surface from yours. The measured detail is in Transparency → Sign-in protection & audit.

Is there a central Settings screen?

Yes. CIQRA has a central Settings area covering billing, domains, languages, notifications, roles, payments, shipping and more.

This section does not walk through it step by step yet. That is a documentation gap, not a product one — and we would rather name it that way round than let a missing article imply a missing feature.

Was this page helpful?