TOTP stands for *Time-based One-Time Password* (RFC 6238). When you enable 2FA, your authenticator app shares a secret with TradeOnyx — encoded in the QR code you scan during setup. From then on, the app derives a new 6-digit code every 30 seconds from that secret + the current time. The login screen asks for that code in addition to your password.
The secret lives only on the backend (Fernet-encrypted at rest) and on your phone. TradeOnyx never sees your code generation logic; the authenticator never sees TradeOnyx's other data. The two sides only exchange the 6-digit code at login time — and that code is useless 30 seconds later.
Backup codes are 10 random strings TradeOnyx generates once when you finish enrolment. Each works exactly once and only when you can't reach your authenticator. Store them in a password manager or print them — you won't see this list again unless you regenerate.
- Mandatory for admins. Admin accounts at TradeOnyx have access to every user's data; the second factor is non-negotiable. The login flow forces the setup at first sign-in for any admin without 2FA.
- Optional but strongly recommended for everyone else. Your trade history is personal data; password reuse across services is the most common breach vector; 2FA closes the door even when the password is wrong-side-of-pwned.
- The 30-second window is generous. TradeOnyx accepts codes from one window before and one window after the current one (±30 s) so a slow-typing user or a slightly drifted phone clock still gets in.
- Backup codes are NOT a fallback for the password. They only substitute the 2FA code. If you forget the password, use the password reset flow — the backup codes won't help.
Setup. Open Settings → Security in the dashboard. Click *Set up 2FA*, scan the QR code with your authenticator app, type the first 6-digit code your app shows, and confirm. TradeOnyx hands you 10 backup codes — save them somewhere your password manager doesn't sync from the same device as your authenticator (different device, ideally a printed copy locked in a drawer).
Daily login. After 2FA is on, sign-in is two steps: email + password as usual, then the 6-digit code from your app. Codes change every 30 seconds — if your code expires before you finish typing, just read the next one.
Lost phone, no backup codes. Reach out to [email protected] with the email on the account. We can clear 2FA after a manual identity check, but the process takes longer than reaching for a backup code. Pre-launch trader life: don't lose both at once.
Replacing the device. Open Settings → Security → *New backup codes* (which invalidates the old ones), then disable + re-enable 2FA on the new device. The new authenticator pairing replaces the old secret cleanly.
Passkeys — the phishing-resistant alternative. Below the 2FA card you'll find the *Passkeys* section. A passkey replaces both password and 6-digit code with a single Face ID / Touch ID / Windows Hello / hardware-key tap. Passkeys are bound to the tradeonyx.io origin — a phishing site can't trigger your authenticator, period. You can use passkeys alongside TOTP (any of the registered methods grants access) or as the only factor. Add one per device you actually sign in from; revoke any you don't recognise the same way you'd revoke a trusted device.