> ## Documentation Index
> Fetch the complete documentation index at: https://docs.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

## User Lockout

User lockout settings establish the criteria for when and for how long a user is temporarily locked out from a known Storefront Gateway User profile (User entity). These settings apply to all Storefront Gateway processes where a user is prompted to provide their password. Configure user lockout from **Admin console** > **Security** > **User Lockout**.

For more details, see user lockout in the Process Catalog.

User Lockout Settings

| App Setting | Description | Default |
| - | - | - |
| **Maximum failed sign-in attempts** | Defines the maximum number of times a user fails to enter the correct password within a specific time frame (defined by the **Failed attempts time window** setting) before user lockout occurs. | 10 |
| **Failed attempts time window** | The length of time (seconds) where a user's total failed sign-in attempts are counted towards a temporary lockout. After this time expires, the failed input counter resets to zero. | 3600 |
| **User lockout duration**\*\*\*\* | The length of time (seconds) that a user lockout lasts. The end user is unable to sign-in for this duration once the number of failed sign-in attempts is reached. | 3600 |

## Multi-Factor Authentication (MFA)

Multi-Factor authentication (MFA) is a security measure that allows a user to register additional methods (or factors) to protect their identity, like a backup mobile number or a third-party authenticator app. Configure MFA from **Admin console** > **Security** > **MFA**.

Some examples of registering a second factors for MFA are:

* A user registers one of their verified Storefront Gateway authN ID (i.e., email) as a second MFA factor.
* A user registers a third-party authentication app to their Storefront Gateway User ID for the second MFA factor.

When the MFA Process executes, Storefront Gateway sends a short form, One-time Passcode (OTP) to the specified (external) channel type. The end user retrieves the OTP and enters it into their client web application for authentication. For more details, see [Multi-Factor Authentication](../../sgRestApiGuide/topics/c_MFA).

MFA Settings

| App Setting | Description | Default |
| - | - | - |
| **2FA Max Retry Verification** | During sign in, this value is the maximum number of retries/attempts a user is allowed for 2FA verification. | 5 |
| **Verification required for MFA registration** | During registration of the MFA method, the end user is prompted to validate the selected channel. | Off**Note:** Enable this setting by dragging the toggle switch right. The user is prompted to validate on the selected channel on future sign-ins. |

## Recaptcha

Storefront Gateway supports Google [reCAPTCHA](https://developers.google.com/recaptcha/docs/invisible)(v2, v3, and enterprise) that implements an "invisible" check that analyzes the user's behavior before a prompt is issued. Configure reCAPTCHA in the [Storefront Gateway Admin Console](adminPortal) under the **Security** > **Recaptcha** page. Recaptcha is off by default and can be enabled by dragging the toggle switch to the right.

For more details, see [Recaptcha Authentication](reCAPTCHA).

Recaptcha Settings

Once you've enable recaptcha configure the shared keys used between your Storefront Gateway instance and the recaptcha site.

| App Setting | Description | Example |
| - | - | - |
| **Default secret key** | The shared key between Storefront Gateway and reCAPTCHA. | 6LdcmqIZAAAAAK2mM3exampleBgplL5UAeCg1lrfBg5siUz |
| **Default site key** | The site key to use for client side integration. | 6LdcmqIZAAAAAHFf4exampleZu7NW30IwJERJKRdYEORwh9 |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.