Setting up two-factor authentication

An account that can place trades deserves a second factor.

Setting it up

1. Settings → Security → Enable two-factor authentication. If your account has a password you are asked to confirm it first ("Confirm it's you").
2. Scan the QR code with any TOTP app — Authy, 1Password, Google Authenticator, Bitwarden — or type the key shown under the code.
3. Enter the 6-digit code and press Confirm and enable 2FA. Two-factor is only switched on once this code is accepted, which proves the app works before the requirement goes live.
4. Store the recovery codes somewhere that is not the phone holding the authenticator. You get 10 single-use codes and they are shown once; press I've saved them — done when they are safe. We also send you an email that 2FA was enabled.

Signing in

After your password, a second step called "Confirm sign-in" asks for the 6-digit code from your app or one of your recovery codes. A code that was already used is refused until the next one appears, and after too many wrong codes you have to wait 15 minutes.

Sessions

Settings → Security → Active sessions lists the devices signed in to your account with device, IP address and country. Revoke signs that device out immediately; Logout everywhere else signs out every session except this one. Changing your password (Settings → Account → Security → Change Password) ends every session, including this one, so you sign in again.

If you lose the authenticator

Recovery codes are the way back in. Enter one in the same field at sign-in. Then open Settings → Security, use Disable 2FA (another unused recovery code is accepted there) and set up two-factor again on the new device. Regenerate recovery codes needs a current 6-digit code from the app, so it is not an option once the authenticator is gone.

Without the authenticator and without recovery codes there is no self-service reset. Message us in the support chat and say what happened. We cannot promise that access can be restored, so keep your recovery codes safe.

If you suspect a compromise

In this order:

1. Stop new trades: Channels → each channel → Disable auto-trading. For a hard stop on a broker account, open it under Trading Accounts and switch Enabled to Disabled, or delete it.
2. Change your password (Settings → Account → Security → Change Password). That signs out every session. Once you are back in, check Active sessions and turn on 2FA if it is not on yet.
3. Rotate broker credentials: change the password at your broker, then delete the account in PipSync and add it again — there is no form to edit saved credentials. Revoke cTrader access at cTrader and delete exchange API keys at the exchange.
4. If your Telegram account may be exposed, end the PipSync login in Telegram → Settings → Devices; that disconnects PipSync until you log in again under Settings → Telegram → Connect Telegram Account.
5. Replace the secrets you handed out: Channels → Sources → TradingView Alerts → Regenerate for the webhook URL, and, on Enterprise, the API keys under Settings → API Keys.
6. Tell us in the support chat what you saw, with rough timestamps.