Storefronts stay public. Dashboard data and admin actions require the server-side admin session.
Enter the 6-digit authenticator code, or one unused recovery code.