A
ApexCommerce
Admin console · staff only · audited
or password
2FA is mandatory for staff
TOTP or passkey — SMS only as fallback. Privileged actions (refunds > $500, role edits, price rules) re-authenticate every time.
Problems? #ops-access in Slack · access reviews run monthly (RBAC phase)