CoinDock Account Security FAQ — 2FA, API Keys, Withdrawal Allowlist

What account security does CoinDock support?

Two-factor authentication (TOTP), with confirmation required at setup and recovery codes issued.
Passkeys — device-bound credentials that cannot be phished.
Email verification, required before account access.
Password confirmation before changing security settings.
Trusted device management, with expiry and revocation.
Scoped API keys, HMAC-signed, separated into read, trade, and withdraw.
Withdrawal address allowlist, with a cooldown before a newly added address becomes usable.
KYC requirements gating trading and withdrawal.

Why does CoinDock ask me to confirm my password to change security settings?

So that someone with access to an already-open session cannot silently alter your authentication.

Session hijacking, an unlocked machine, or a borrowed device all give an attacker your logged-in state without your password. Requiring the password again at the moment security settings change closes that gap. It applies to enabling or disabling 2FA and to registering a passkey.

Should I use a passkey or an authenticator app?

A passkey is stronger against the attack that actually happens, which is phishing.

A TOTP code can be relayed: a fake site asks for it and forwards it to the real one in real time. A passkey is bound to the CoinDock domain, so the browser will not offer it to a lookalike — there is nothing to type and nothing to relay.

A reasonable configuration is a passkey as primary with TOTP retained as a fallback, and recovery codes stored offline.

Where should I keep my recovery codes?

Offline, and not on the device that holds your authenticator.

Recovery codes bypass 2FA entirely, so treat them as being as sensitive as your password. Print them, or store them in a password manager separate from the authenticator device.

The most common 2FA failure is not an attacker — it is losing one phone and discovering both the authenticator and the only copy of the recovery codes were on it.

Each code works once. Regenerate the set if you suspect exposure; regenerating invalidates the old codes.

What are API key scopes and why do they matter?

CoinDock API keys carry permissions separately: read, trade, and withdraw. Requests are HMAC-signed rather than sent with a bearer token.

Scopes matter because they bound the damage of a leak:

Scope leaked	Consequence
`read`	Information disclosure — your balances and history
`trade`	An attacker can move your position, but not remove funds
`withdraw`	Direct loss

Grant the narrowest scope that does the job. A trading bot that never withdraws should not hold a withdraw-scoped key. If you are unsure whether something needs a scope, it does not.

Review keys periodically and revoke unused ones. An abandoned key with withdraw scope is a permanent hole that survives every password change and 2FA setup.

Do API keys bypass my 2FA?

They authenticate independently. An API key is a separate credential, so a valid signed request does not present a 2FA challenge — that is what makes automation possible.

This is why scoping matters so much. Your 2FA protects the login path; it does not protect the API path. The controls there are scope limitation, key rotation, and revoking what you do not use.

What is the withdrawal address allowlist and cooldown?

You can register withdrawal addresses in advance. A newly added address is subject to a cooldown period before it can be used.

The purpose is to remove the value of momentary account access. An attacker who briefly gains control cannot add their own address and immediately withdraw — the cooldown creates a window in which you can notice and revoke.

Practical consequence: add your withdrawal addresses before you need them. The cooldown protects you at exactly the cost of being inconvenient in a hurry, which is the trade-off it is designed to make.

What are trusted devices?

Devices you have marked as recognised, so you are not challenged on every login. They carry an expiry and can be revoked individually.

Review the list periodically and after anything unusual. Revoke anything you do not recognise, and revoke everything if you suspect compromise. A device you sold, lent, or lost should be revoked immediately.

My account may be compromised. What do I do, in what order?

From a clean device:

Change the password.
Revoke trusted devices and active sessions.
Revoke API keys — particularly anything with trade or withdraw.
Check the withdrawal allowlist for addresses you do not recognise.
Confirm 2FA is still yours, and regenerate recovery codes.
Secure your email, which can reset most other accounts.

Then contact CoinDock through the published channels on coindock.online/about — reached by typing the domain, never by following a link in a message.

Does CoinDock account security protect my self-custody wallet?

No. They are entirely separate.

2FA, passkeys, and trusted devices protect your CoinDock account. They have no bearing on a wallet you control yourself: anyone with that seed phrase controls those funds regardless of your exchange settings.

See wallet safety guide for the self-custody side.

CoinDock Account Protection — Frequently Asked Questions