Account Security Card

About this block

Account Security Card orders the sign in story correctly for 2026, the passkey first as the active method, nothing to phish, nothing to forget, the password demoted to the backup with the sign out everywhere side effect disclosed, and the session list with per device sign out plus the everywhere button.

Sessions are one array. Shop accounts hold addresses and cards, the security page deserves shop grade clarity.

When to use

Reach for this block as the security tab of account settings. The session list with locations is the feature customers check after a phishing scare, make it findable before the scare.

A natural flow around it on an Ecommerce Pro page:

Before

• Account overview

After

• Data privacy controls as the neighboring tab

What you can display

One strong use is passkey plus sessions. Other cards:

• Two factor setup. The code app flow for stores without passkeys yet.
• Login history. The audit trail version with times and rough places.
• Trusted devices. Skip verification on these, with removal.

Tip: changing it signs out everywhere else automatically is the side effect users want and never know they have, disclosing it is the security UX.