Account security covers two-factor authentication, the extra password confirmation sensitive actions ask for, and managing where you're signed in.
Two-factor authentication
Two-factor authentication is optional, and only you can turn it on or off — doing either always asks you to confirm your password first. Once it's on, set up your authenticator app by scanning the QR code (or entering the secret key manually), then enter the 6-digit verification code to confirm. You also get 8 one-time backup codes — save them somewhere safe, since each one only works once.
Confirming your password for sensitive actions
Some actions — changing your two-factor settings, registering or rotating a wallet key, deleting your account, and most admin actions — ask you to confirm your password again first, even if you're already signed in. This short re-confirmation window protects you even if someone got hold of your browser session but not your password.
Managing your sessions
Active sessions lists every device currently signed in to your account. You can sign out one device, or use Sign out all to end every session except the one you're using right now.
API tokens
You can hold up to 10 active API tokens at a time, for letting an external app or device call the API on your behalf — for example, the Rokid AI-glasses connector. Creating or revoking a token also asks you to confirm your password.
Deleting your account
See Create an account and sign in for what happens when you delete your account, including why a wallet on the QXC network can block it.
Manage all of this from Settings → Security and Settings → API token. For the exact messages these actions can show, see Limits and error codes.