Direct answer

To enable two-factor authentication on CoinDock, go to your account security settings, choose two-factor authentication, confirm your password, scan the QR code with an authenticator app, and confirm setup by entering a generated code. CoinDock requires that confirmation step, so 2FA is not active until you prove the app works — which prevents locking yourself out with a misconfigured authenticator. Store the recovery codes offline before you finish.

Prerequisites

An authenticator app on your phone or desktop — any TOTP-compatible app works.
A safe place to store recovery codes that is not the same device as the authenticator.

Step 1 — Open security settings

You will be asked to confirm your password before changing 2FA settings. This is deliberate: it means someone who finds your session open on an unlocked machine still cannot silently alter your authentication.

Step 2 — Scan the QR code

Choose two-factor authentication and scan the displayed QR code with your authenticator app.

If you cannot scan — a desktop authenticator, a camera problem — use the text setup key shown alongside the code. It encodes the same secret.

Set up on a device you control and can back up. If your authenticator lives only on one phone and that phone is lost, recovery codes are the only way back in. Some authenticator apps offer encrypted backup; if yours does, enable it.

Step 3 — Confirm with a generated code

Enter the six-digit code your app displays.

CoinDock requires this confirmation, so two-factor authentication is not enabled until you complete it. This matters more than it sounds: a system that enables 2FA without confirmation will happily lock you out of your own account if the authenticator was misconfigured or the clock was wrong.

If the code is rejected, the usual cause is clock drift — TOTP codes depend on accurate time. Enable automatic time synchronisation on the device running the authenticator and try again.

Step 4 — Store recovery codes properly

You will be shown a set of single-use recovery codes. These are the way back in when the authenticator is unavailable.

Treat them as being as sensitive as your password, because they bypass 2FA entirely:

Store them offline — printed, or in a password manager separate from the authenticator device.
Do not photograph them or keep them in the same phone that holds your authenticator. A single lost device should not take both factors with it.
Each code works once. Note which you have used.
Regenerate them if you suspect exposure. Regenerating invalidates the old set.

The most common 2FA failure is not an attacker defeating it. It is a person losing a phone and discovering the recovery codes were only ever on that phone.

Step 5 — Consider a passkey

CoinDock also supports passkeys, which are a different mechanism rather than a second code.

A passkey is a cryptographic credential bound to your device and to the CoinDock domain. Because the browser will only offer it to the real domain, a passkey cannot be phished — a lookalike site cannot ask for it, and you cannot be persuaded to type it somewhere, since there is nothing to type.

	TOTP (authenticator app)	Passkey
What you provide	A six-digit code	A device-held credential
Phishable	Yes — a code can be relayed to a fake site	No — bound to the domain
Works across devices	Yes, if the app syncs	Depends on platform sync
Needs recovery codes	Yes	Keep a fallback method

Passkeys are stronger against the most common real attack, which is phishing. Adding a passkey while keeping TOTP as a fallback is a reasonable configuration.

Step 6 — Verify it works before you need it

Log out and log back in once. Confirm the prompt appears and your code is accepted.

Testing at setup time, when you still have every credential in front of you, is far better than discovering a problem in a hurry later.

What 2FA does and does not protect

Protects against: a stolen or reused password, a credential-stuffing attempt, and someone who has your password from a breach elsewhere.

Does not protect against:

Seed phrase disclosure. 2FA guards your CoinDock account; it has no bearing on a self-custody wallet. Anyone with your seed phrase controls those funds regardless.
Malicious token approvals, which happen on-chain and never touch your exchange account.
Real-time phishing, where a fake site relays your code to the real one as you type it. This is the specific gap passkeys close.
Malware on the device you log in from.

2FA is necessary and not sufficient. It closes the password-theft path, which is worth doing, and leaves the on-chain and social paths open.

API keys are a separate surface

If you use CoinDock's API, note that API keys authenticate independently of your login and 2FA. They are HMAC-signed and scoped — a key can carry read, trade, or withdraw permission separately.

Grant the narrowest scope that does the job. A read-only key that leaks is an information disclosure; a withdraw-scoped key that leaks is a loss. See account protection.

How to Set Up Two-Factor Authentication on CoinDock