Securing Your Account: Access Tokens, 2FA, and Sessions

Your account has exactly one credential: a random numeric access token generated at signup. There is no email, no password, and no recovery flow — which is excellent for privacy and unforgiving if you lose the token. This guide covers how the token model works, how to store the token safely, how to add TOTP two-factor authentication with backup codes, how to audit and revoke active sessions, and how to keep your proxy credentials separate from the account itself.

The design is deliberate. Because the platform never asks for an email, a phone number, or identity documents, there is nothing personal tied to your account and nothing to leak. The trade-off is that all responsibility for the credential shifts to you: the platform cannot reset what it does not know.

If you have not created an account yet, the getting started guide walks through registration. Everything below happens on the Settings page of the dashboard.

01 How the token model works

Registering generates a random numeric access token. That token is your identity: you paste it into the login form and you are in. There is no username, no password to rotate, and no KYC step at any point.

During login your browser also solves an invisible proof-of-work challenge — you will not see it, and there is nothing to click. Once you are in, dashboard traffic is end-to-end encrypted with an X25519 key exchange and ChaCha20-Poly1305 on top of TLS, so sensitive dashboard data is encrypted even beyond the transport layer.

Warning

The token cannot be recovered. There is no email reset, no support-side restore, no exceptions. If you lose the token and have no backup, the account and everything in it is unreachable.

02 Storing the token safely

Treat the token like a private key, because functionally it is one. Two independent copies in two different places is the minimum sensible setup.

Save it in a password manager as the primary copy — this also protects it with the manager's own encryption and sync.
Keep one offline copy: written on paper or stored on an encrypted drive that does not sync to the cloud.
If several people operate the account, share the token only through channels you would trust with a wallet seed phrase, and know exactly who holds a copy.

Warning

Never put the token in shared documents, code repositories, screenshots, ticket messages, or chat logs. Tokens pasted into a repo or a screenshot are effectively public — anyone who sees the token owns the account.

03 Enable two-factor authentication

TOTP two-factor authentication is optional but strongly recommended: with 2FA enabled, a leaked token alone is no longer enough to log in.

01Open Settings in the dashboard and start the 2FA setup.
02Scan the QR code with any TOTP app, or enter the secret manually if you cannot scan.
03Confirm with the current 6-digit code from the app to activate 2FA.
04Save the 8-character single-use backup codes provided when you enable 2FA. Each code works exactly once.

Note

Store the backup codes with the same care as the token itself — offline, separate from the device running your TOTP app. If your phone dies, a backup code is the only way past the 2FA prompt.

04 Review active sessions

The Settings page lists every active dashboard session with device information. Make a habit of scanning it, especially after logging in from a new machine or a network you do not control.

Revoke any session you do not recognize immediately.
If you find an unfamiliar session, assume the token is compromised: revoke everything, then re-secure the account starting with 2FA.
Log out of sessions on shared or borrowed devices rather than leaving them open.

You can also monitor and clear sessions programmatically: the user API exposes GET /sessions, POST /sessions/clear, and POST /sessions/clear-all. See the user API guide for setup — the API is opt-in and locked to a single whitelisted IP, which is itself a useful security property.

05 Proxy credential hygiene

Your proxy user:pass credentials are separate from the account token. They live in scripts, config files, and third-party tools — places with a much larger exposure surface — so treat them as leakable and plan for rotation.

If proxy credentials appear in a shared script, a public repo, or a pastebin, regenerate them from the proxy generator. Old credentials stop working immediately.
Regeneration only affects proxy access; your account token and dashboard sessions are untouched. Update your tools with the new credentials afterward.
If a machine has a fixed IP, consider IP whitelist auth instead: up to 3 exact IPs can connect to <proxy-host>:80 with no username or password, so there is nothing to leak from that machine's configs.

Note

After regenerating, expect auth errors from any tool still using the old credentials. The troubleshooting guide covers diagnosing 407 and connection failures quickly.

06 Deleting your account

Permanent account deletion is available on the Settings page. It is exactly what it says: once completed, the account is gone and cannot be restored, by you or by the platform.

Warning

Deposits are non-refundable once credited (see the refund policy), and balance and GB never expire — so there is no reason to rush a deletion. Use up what you paid for first.

07 Recognizing phishing attempts

Because the token is the whole credential, phishing is the main realistic attack against this account model. The defenses are simple and absolute.

Always check the domain in the address bar before pasting your token into a login form. Bookmark the real dashboard and log in from the bookmark.
No legitimate flow ever asks you to send your token to another person — not in a support conversation, not to "verify" your account, not to claim a bonus. Anyone asking for your token is an attacker.
Contact support only through the support tickets page in your dashboard, and even there, never share the token itself — support will never ask for it.

Combine that discipline with a stored backup, active 2FA, and periodic session reviews, and the account model works strongly in your favor: nothing personal to steal, one secret to guard, and full control over who is logged in.