We’re introducing the following security requirements to help protect your ShipHero account.
These changes will roll out over the coming days, with MFA becoming mandatory for all users on January 1, 2027.
- Starting January 1, 2027, MFA will be required for all users. We strongly recommend enabling it now.
- Users who have not logged in for 90 days will need to reset their passwords before regaining access.
- Users who are deactivated and then reactivated will need to reset their passwords before regaining access.
- Users whose passwords are detected as exposed in a known third-party data breach may be required to reset their passwords and use MFA before regaining access.
- API tokens unused for 90 days will be revoked. Please review any infrequently used integrations.
- Creating a Manual Order will require MFA, as issuing refunds already does.
- Logins flagged for impossible travel will require MFA verification, even before January 1. This means logins from locations too far apart to reasonably travel between in the elapsed time.
Customers using SSO should enforce strong password policies and enable MFA through their organization’s identity provider. We strongly encourage both to help protect access to ShipHero.
For help enabling MFA, see our MFA setup guide.
If you need help preparing or completing MFA verification, contact ShipHero Support.