Skip to main content

Account security

Web appLast verified 4 Nov 2026

Your account has three security mechanisms: two-factor authentication (2FA) on every login, a list of logged-in devices you can sign out, and API keys you control. All three live in Settings.

Two-factor authentication (2FA)​

2FA adds a 6-digit code from an authenticator app (Google Authenticator, Authy, 1Password and similar) to every login, after the email code, Google or wallet step.

Security tab with the Two-factor authentication (2FA) card, the status Disabled and the Enable button
  • Requires an email. 2FA can only be turned on for an account with an email, because turning it on or off needs an email code as well as an authenticator code.
  • Enabling signs out other devices. Every other session ends at once. Log in again there with your email code and the authenticator code.
  • Login window. Each 2FA prompt is valid for 5 min. After several wrong codes in a row you wait a few minutes before the next try.
No backup codes

Catapult does not issue backup codes. When you set up 2FA, store the manual entry key somewhere safe, or use an authenticator app that syncs to a second device. If you lose the app and the key, contact support through the in-app chat.

Active sessions​

Every device logged in to your account is a session, listed with its approximate location, IP address, operating system and browser, and last access time. You can end all sessions except the current one in one action: those devices are logged out at once. If you see a device you do not recognise, do this and then turn on 2FA.

Active Sessions tab with session cards showing operating system, browser and last access time, location and IP hidden, and the Terminate All Other Sessions button

API keys​

API keys let your own scripts and bots trade Synthetic tokens through the Public API.

  • Up to 20 active keys per account, each with an expiry date. A key is shown once, when you create it.
  • A key can trade, create tokens and buy boosters with your balance. It cannot deposit or withdraw.
  • Revoking a key stops it at once and cannot be undone.

Treat an API key like a password: anyone who has it can trade with your balance. Full rules: API keys.

Hide sensitive info​

Hide sensitive info in your account settings masks your email, IDs and wallet addresses with * across the app. Use it before you share your screen or a screenshot.

Safety checklist​

  • Turn on 2FA.
  • Check your active sessions after you log in on a shared or new device.
  • Revoke API keys you no longer use.
  • Never share your login code, your 2FA code or an API key.
  • Withdraw only to addresses you control. See Deposits and withdrawals.