Skip to main content

​
Short answer

Beyond your password, adding a second verification step is the single most valuable thing you can do for account security:
  • Passkey — sign in with a fingerprint, face, or device screen lock; the private key never leaves your device;
  • 2FA (two-factor authentication) — on top of your password, enter a one-time code from an authenticator app that refreshes every 30 seconds.
Once bound, even if your password leaks, no one can sign in without your device or your one-time code. The entry point is Profile → https://api.apiyi.com/account/profile, and it takes just a few minutes.
Every user should bind one. Big account or small — your account holds a balance, usage history, and your API keys. A second factor is the lowest-cost, highest-return line of defense. We recommend binding a Passkey first, then adding 2FA as a backup.

​
Why a password alone isn’t enough

Many people assume “my password is complex, so I’m safe.” But the most common ways a password leaks all happen on your own side, and have nothing to do with how strong the password is:
  • Your computer is infected with info-stealer malware: this kind of malware grabs every login saved in your browser in bulk — to it, even the strongest password is plaintext.
  • You reused the same password elsewhere: after another site is breached, attackers replay the leaked “username + password” pairs everywhere — this is called credential stuffing.
  • Phishing: a fake login page tricks you into typing your password in.
In all of these, the password is already in someone else’s hands before it ever reaches us.
To be clear: this is not a leak on our side. Our database stores only password hashes, never plaintext — even if the database were breached, your original password couldn’t be recovered. But the leaks above all happen on the user’s device/browser side, and a password alone can never stop them — a second factor is the only thing that defends against the “password already leaked” case: even with your password, an attacker has neither your Passkey device nor your one-time code.

​
Two second factors — which to choose

Passkey (recommended first)

Sign in with fingerprint / face / screen lock, no password to remember. The private key stays local to your device — phishing- and credential-stuffing-resistant by design. Smoothest for everyday sign-in.

2FA / Two-factor (add this too)

Use an authenticator app such as Google Authenticator or Microsoft Authenticator and enter the code that refreshes every 30 seconds. A reliable backup when you switch devices or need to recover access.
We suggest binding both: the Passkey handles fast everyday sign-in, and 2FA is your fallback when you switch phones or sign in temporarily on another device. For Passkey details, see How do I sign in with a Passkey.

​
How to bind

1

Open your profile

After signing in, open https://api.apiyi.com/account/profile, or click Profile in the left navigation.
2

Bind a Passkey

Scroll to Account Options at the bottom of the page, click Bind Passkey, choose where to save it (iCloud Keychain / Google Password Manager / this browser), and confirm with fingerprint, face, or screen lock. Full steps are in How do I sign in with a Passkey.
3

Bind 2FA

In the 2FA section further down the profile page, scan the QR code with an authenticator app, then enter the 6-digit code it shows to confirm.
Be sure to save your backup (recovery) codes. When you bind 2FA, the system gives you a set of one-time backup codes — they are your only way back in if you switch phones, lose the device, or delete the authenticator by mistake. Write them down or store them in a password manager; don’t just screenshot them onto the same phone.
Binding is done while signed in, so you can bind right after you log in. It only adds a verification method — it does not affect your balance, tokens, or call history.

​
Can’t bind / switching devices

First sign out and sign back in, wait about a minute, and try again. If it still fails, switch to the latest Chrome / Edge / Safari and make sure your device has a screen lock or biometrics set up.
Sign in with the backup codes you saved when binding, then go to your profile and re-bind a new 2FA. If you have no backup codes and can’t sign in, contact support at [email protected] to verify your identity and unbind.
It depends on where it’s saved: Passkeys in iCloud Keychain or Google Password Manager sync across devices; one saved only in a local browser won’t sync and must be re-bound on the new device. See How do I sign in with a Passkey.
Yes. A second factor adds a layer; it does not replace password login. To be safe, keep your password, keep your registration email reachable, and save your 2FA backup codes — always keep at least one working recovery method.
Account login security ≠ API Key security — they are two different things. 2FA / Passkey protect your sign-in to the web console; the API keys your programs use have their own security practices, covered in How to securely manage API keys.