Three questions settle nearly every lockout: is the account suspended, is two-factor authentication involved, and was the account created recently. Work through them in that order, because each has a different fix and the first two take seconds to check.
You can get a customer moving at any point using Log in as Customer, which lets you act on their behalf while you sort out their access.
Before you start
Open the customer's details page in Storefront Manager. Everything below starts from there.
Step 1: Check the account status
If the account shows Suspended, that is the lockout. Change the status back to Active and ask the customer to try again.
If the account shows Active, move to step 2.
Step 2: Send a password reset
For an active account, a forgotten or mistyped password is the most likely cause. Use Send password reset email on the customer details page.
This is also the quickest way to get a customer into a new account when their welcome email never arrived, because it does not depend on resending the original.
If the reset email does not arrive, ask the customer to check their spam folder, then confirm the email address on their account is correct. A wrong address on the account blocks every email you send, not just this one.
Step 3: Check whether the account is new
Newly created accounts fail differently from established ones.
The password-reset link in a welcome email is only valid for a limited time. If the customer is acting on an old welcome email, the link has expired. Ask them to use Forgot password on your Storefront login page, or send a fresh reset from their details page.
For accounts created by a domain import, the welcome email goes to the WHOIS Owner contact email recorded at import time. If that address was wrong, the email reached someone else and the customer never had access. Confirm the address, then push the domain to the correct account. Import emails are only sent for domains that imported successfully, so a customer with a failed import never receives one.
When two-factor authentication is blocking them
Their authenticator code is rejected
Codes refresh every 30 seconds, and entering one in its final second or two causes a timing mismatch. Ask them to wait for a fresh code and try again.
If codes keep failing, their device clock has drifted. Most authenticator apps have a Sync time or Fix time sync option in settings.
They are locked out with no recovery codes
The customer cannot resolve this alone. Disable their 2FA from Storefront Manager. They can then log in with their password and set 2FA up again.
A recovery code did not work
Each recovery code works once. If they have already used the one they tried, it will not work again. Ask them to try another unused code. If every code is spent and the authenticator is also gone, disable their 2FA from Storefront Manager.
They are switching phone or authenticator app
They should disable 2FA while they still have the old app working, then set it up again on the new device. If they have already lost the old app, disable 2FA from Storefront Manager first.
You cannot see the Disable button
The Disable button only appears when the customer has 2FA enabled. If their status shows Disabled, 2FA is already off and is not what is blocking them.
They logged in, but their domains are missing
This presents as a login problem and is usually a second account. Customers who ordered more than once, or whose domains were imported under a different contact email, end up with duplicates.
Use the domain push tool to move the domains onto the account they are actually using. Open the domain, open the ellipsis menu, and select Change Customer, then choose the correct account. The tool is available from the domain details page whichever customer currently holds the domain, so a push sent to the wrong account can simply be pushed again.
Once the domains are consolidated, suspend the empty account or leave it as it is.
A customer says something changed and they did not do it
Open the domain's event log and find the change, then read the By column.
Reseller means you or someone on your team made the change from Storefront Manager. As Customer means a reseller was logged in as the customer at the time. Customer means the change came from the customer's own session.
This usually resolves the question without any account changes, and it tells you whether the customer's credentials are actually at risk.
When to contact OpenSRS Support
Contact OpenSRS Support when the account is Active, a password reset has been delivered and used, 2FA is off or confirmed working, and the customer still cannot log in. Include the customer's username and the email address on the account.
Related articles
- Working with customers and domains
- Two-factor authentication for customers
- Importing OpenSRS domains
- Emails sent to your customers
- Using the event log
Full Storefront documentation
These troubleshooting articles cover what to do when something breaks. Setup guides, feature documentation and the Storefront API reference all live on the Storefront documentation portal.