---
title: Protect the accounts that control your app
description: >-
  Turn on two-step authentication for every account that can change your app's
  code, configuration, infrastructure, or DNS, and remove access as soon as
  people no longer need it.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/protect-the-accounts-that-control-your-app
  md: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/protect-the-accounts-that-control-your-app.md
---

# Protect the accounts that control your app

Turn on two-step authentication for every account that can change your app's code, configuration, infrastructure, or DNS, and remove access as soon as people no longer need it.

***

## Why

Any account that can change your app's code, configuration, infrastructure, or DNS can be used to put code on every store that uses your app, without a vulnerability in the code.

***

## How

* Turn on two-step authentication for every Shopify account in your Partner organization.
* Require multi-factor authentication on your hosting, cloud, DNS, CDN, source control, CI/CD, package registry, error tracking, and email accounts. Email matters because it can reset the passwords for everything else.
* Give each person their own account with only the access that they need. Don't share logins.
* Remove access as soon as someone leaves or changes roles, including Partner organization access, store collaborator access, cloud and repository access, and any API keys or tokens that they created.
* Keep your [emergency developer contact](https://shopify.dev/docs/apps/build/dev-dashboard/technical-updates#update-the-contact-details-for-a-partner-organization) current in the Partner Dashboard, so Shopify can reach you quickly about a security issue.

***

## Verify

No app security check covers this practice, because it lives outside your code. Review it when people join or leave your team.

***