Account security

Two-factor authentication

1. 1

   Settings → Security → enable 2FA

   Scan the QR code with any TOTP app — Authy, 1Password, Google Authenticator.

2. 2

   Confirm with a code

   This proves the app is set up before the requirement goes live.

3. 3

   Store the recovery codes

   Somewhere that is not the phone holding the authenticator. They are shown once.

Sessions and devices

• Settings → Security lists active sessions with device and location.
• Revoking a session logs that device out immediately.
• Changing your password ends all other sessions.

How your broker credentials are held

• Credentials are encrypted at rest and are never returned by the API or written to logs.
• cTrader uses OAuth, so no password exists to store — revoke access at cTrader any time.
• MetaTrader logins cannot withdraw. Exchange API keys should be created without withdrawal rights.

The full picture is on the security page.

If you suspect a compromise

1. 1

   Disable every account

   Switch each account to Disabled under Trading Accounts. No new signal orders are placed on a disabled account. It does not close open positions.

2. 2

   Change your password and revoke sessions

   Under Settings → Security.

3. 3

   Rotate broker credentials

   Change the MT password at your broker, revoke cTrader access, delete exchange API keys.

4. 4

   Regenerate webhook URLs and API keys

   Anything that was shared is now untrusted.

5. 5

   Tell support

   With rough timestamps. The audit log makes the rest reconstructable.