> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xblu.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-factor and passkeys

> Protect your account with an authenticator app, recovery codes and passkeys.

With two-factor authentication on, a password on its own no longer opens your account. It is required before a first deposit and for every withdrawal.

## Turn on two-factor authentication

**1. Open Security**

Click the gear at the top right, open **Settings**, then **Security**. Next to **Two-factor authentication**, click **Set up**.

**2. Scan the code**

Click **Show the code**, then scan the QR code with your authenticator app. If you cannot scan, enter the key shown under **OR ENTER THE KEY**.

**3. Enter the six digits**

Type the **SIX-DIGIT CODE** your app shows and click **Turn on**.

**4. Create your recovery codes**

The app offers to create your recovery codes. Do it now. See below.

![The Turn on 2FA screen](https://mintcdn.com/xblu/w0Wp6w4XTfxdrP8i/images/en/two-factor.jpg?fit=max\&auto=format\&n=w0Wp6w4XTfxdrP8i\&q=85\&s=b3b623d34d441bc9a6b6e8f73f56055e)

## Recovery codes

Ten single-use codes that open the account if you lose your phone. They are shown only once: **Download** or **Print** them, and keep them off the device you trade on. Tick **I have put these codes somewhere safe** to continue.

A recovery code works once. **Security** shows how many you have left. **Regenerate** replaces the whole set.

## Passkeys

A passkey signs you in with your device's own lock: your face, your fingerprint or its PIN. It only works on the Xblu site, so a copied page gets nothing from it.

In **Security**, next to **Passkeys**, click **Add**, name it (for example "My phone") and follow your device. Then **Sign in with a passkey** on the sign-in page.

A passkey also counts as your second factor. Keep at least one other: you cannot remove your only second factor.

> [!NOTE]
>
> Adding a passkey makes withdrawals wait 24 hours, as any change to how you sign in does.

## Lost your phone and your recovery codes

On the sign-in page, click **Lost your phone and your recovery codes?** Enter your email and password, then open the link we send to confirm.

This starts a seven-day wait. We tell you every day, on every channel, with a link to cancel. At the end, two-factor is removed and withdrawals wait 24 hours. Signing in with a code during the wait cancels the request.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.