How to Set Up Two-Factor Authentication (2FA)
Add an extra layer of security to your Midas account with time-based one-time passwords using an authenticator app.
Two-factor authentication puts a second, offline factor between your email inbox and your balance. It matters more on Midas than on a password-based exchange: because sign-in starts with a magic link, anyone who reaches your mailbox reaches your account, and 2FA is what stops that from being enough. The codes come from an app on your phone and change every thirty seconds, so an attacker needs the phone in hand, not just the inbox.
Before you start
- A phone or tablet that can run an authenticator app — Google Authenticator, Authy, 1Password and Bitwarden all work.
- Somewhere safe to keep backup codes that is not the same phone. Printed, or in a password manager, both count.
- A couple of undisturbed minutes: the QR code and the first verification have to be completed in one sitting.
Open Security Settings
Navigate to Profile > Security > Two-Factor Authentication. You will see the current status of 2FA on your account. If it is not yet enabled, tap 'Enable 2FA' to begin the setup process.
Install an Authenticator App
Download a TOTP-compatible authenticator app if you do not already have one. Popular options include Google Authenticator, Authy, and Microsoft Authenticator. These apps generate time-based codes that refresh every 30 seconds.
Scan the QR Code
Midas will display a QR code on your screen. Open your authenticator app, tap the '+' or 'Add Account' button, and scan the QR code with your camera. If you cannot scan, manually enter the secret key shown below the QR code.
Save Your Backup Codes
Midas will provide a set of one-time backup codes. Write these down and store them securely offline. These codes allow you to regain access if you lose your authenticator device. Never share these codes with anyone.
Enter the Verification Code
Type the six-digit code currently displayed in your authenticator app into the confirmation field on Midas. Tap 'Verify' to complete the setup. From now on, you will be asked for a 2FA code when signing in and performing sensitive actions such as withdrawals.
If something goes wrong
- The code is rejected as invalid every time.
- Almost always clock drift on the phone. Turn on automatic date and time in the phone's settings, then try the next code. In Google Authenticator you can also use the built-in time-correction option.
- You scanned the QR code but the app shows no entry for Midas.
- Scan again before leaving the setup screen. The QR code is only shown during setup; if you have already left, start the flow again from Security settings rather than hunting for the old code.
- You have lost the phone with the authenticator on it.
- Use a backup code to sign in, then remove the old 2FA entry and register the new phone immediately. Each backup code works once. If the codes are gone too, recovery is a support process and deliberately slow.
Frequently asked questions
- Which authenticator app should I use?
- Any app that supports standard time-based codes. Google Authenticator and Authy are the common choices; a password manager with a built-in authenticator is convenient but keeps both factors in one place, which is a trade-off worth making consciously.
- What are backup codes for?
- They are single-use codes that stand in for the authenticator when you cannot reach it — a lost, wiped or stolen phone. Store them away from that phone, because backup codes on the same device solve nothing.
- Can I use both 2FA and a passkey?
- Yes, and it is the stronger setup. A passkey handles day-to-day sign-in on a trusted device; 2FA still guards sensitive actions and gives you a way in from a device that has no passkey registered.
- Does 2FA apply to withdrawals as well as sign-in?
- Yes — that is most of its value. An attacker who somehow reaches an open session still cannot move funds out without the current code.