> ## Documentation Index
> Fetch the complete documentation index at: https://docs.apiyi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How Do I Keep My Account Secure? Why Bind 2FA and a Passkey?

> Add a second verification step to your APIYI account: bind a Passkey (fingerprint/face) or 2FA (authenticator code). Even if your password leaks, no one can sign in without the second factor. Every user should bind one — it takes a few minutes.

## Short answer

Beyond your password, adding a **second verification step** is the single most valuable thing you can do for account security:

* **Passkey** — sign in with a fingerprint, face, or device screen lock; the private key never leaves your device;
* **2FA (two-factor authentication)** — on top of your password, enter a one-time code from an authenticator app that refreshes every 30 seconds.

Once bound, **even if your password leaks, no one can sign in without your device or your one-time code**. The entry point is **Profile → `https://api.apiyi.com/account/profile`**, and it takes just a few minutes.

<Info>
  **Every user should bind one.** Big account or small — your account holds a balance, usage history, and your API keys. A second factor is the lowest-cost, highest-return line of defense. We recommend **binding a Passkey first**, then adding **2FA** as a backup.
</Info>

## Why a password alone isn't enough

Many people assume "my password is complex, so I'm safe." But the most common ways a password leaks all happen **on your own side, and have nothing to do with how strong the password is**:

* **Your computer is infected with info-stealer malware**: this kind of malware grabs every login saved in your browser in bulk — to it, even the strongest password is plaintext.
* **You reused the same password elsewhere**: after another site is breached, attackers replay the leaked "username + password" pairs everywhere — this is called credential stuffing.
* **Phishing**: a fake login page tricks you into typing your password in.

In all of these, the password is already in someone else's hands before it ever reaches us.

<Note>
  To be clear: this is **not** a leak on our side. Our database stores **only password hashes, never plaintext** — even if the database were breached, your original password couldn't be recovered. But the leaks above all happen on the user's device/browser side, and a password alone can never stop them — **a second factor is the only thing that defends against the "password already leaked" case**: even with your password, an attacker has neither your Passkey device nor your one-time code.
</Note>

## Two second factors — which to choose

<CardGroup cols={2}>
  <Card title="Passkey (recommended first)" icon="fingerprint">
    Sign in with fingerprint / face / screen lock, no password to remember. The private key stays local to your device — **phishing- and credential-stuffing-resistant by design**. Smoothest for everyday sign-in.
  </Card>

  <Card title="2FA / Two-factor (add this too)" icon="shield-check">
    Use an authenticator app such as Google Authenticator or Microsoft Authenticator and enter the code that refreshes every 30 seconds. A reliable backup when you switch devices or need to recover access.
  </Card>
</CardGroup>

**We suggest binding both**: the Passkey handles fast everyday sign-in, and 2FA is your fallback when you switch phones or sign in temporarily on another device. For Passkey details, see [How do I sign in with a Passkey](/en/faq/passkey-login).

## How to bind

<Steps>
  <Step title="Open your profile">
    After signing in, open `https://api.apiyi.com/account/profile`, or click **Profile** in the left navigation.
  </Step>

  <Step title="Bind a Passkey">
    Scroll to **Account Options** at the bottom of the page, click **Bind Passkey**, choose where to save it (iCloud Keychain / Google Password Manager / this browser), and confirm with fingerprint, face, or screen lock. Full steps are in [How do I sign in with a Passkey](/en/faq/passkey-login).
  </Step>

  <Step title="Bind 2FA">
    In the **2FA** section further down the profile page, scan the QR code with an authenticator app, then enter the 6-digit code it shows to confirm.

    <Warning>
      **Be sure to save your backup (recovery) codes.** When you bind 2FA, the system gives you a set of one-time backup codes — they are your only way back in if you switch phones, lose the device, or delete the authenticator by mistake. Write them down or store them in a password manager; don't just screenshot them onto the same phone.
    </Warning>
  </Step>
</Steps>

<Tip>
  Binding is done while **signed in**, so you can bind right after you log in. It only **adds** a verification method — it does not affect your balance, tokens, or call history.
</Tip>

## Can't bind / switching devices

<AccordionGroup>
  <Accordion title="Clicked bind but it failed / won't bind?">
    First **sign out and sign back in**, wait about a minute, and try again. If it still fails, switch to the latest Chrome / Edge / Safari and make sure your device has a screen lock or biometrics set up.
  </Accordion>

  <Accordion title="Switched phones / deleted the authenticator?">
    Sign in with the **backup codes** you saved when binding, then go to your profile and re-bind a new 2FA. If you have no backup codes and can't sign in, contact support at `support@apiyi.com` to verify your identity and unbind.
  </Accordion>

  <Accordion title="Will the Passkey still work on a new device?">
    It depends on where it's saved: Passkeys in iCloud Keychain or Google Password Manager sync across devices; one saved only in a local browser won't sync and must be re-bound on the new device. See [How do I sign in with a Passkey](/en/faq/passkey-login).
  </Accordion>

  <Accordion title="Can I still use my password after binding a second factor?">
    Yes. A second factor **adds** a layer; it does not replace password login. To be safe, keep your password, keep your registration email reachable, and save your 2FA backup codes — always keep at least one working recovery method.
  </Accordion>
</AccordionGroup>

<Note>
  **Account login security ≠ API Key security** — they are two different things. 2FA / Passkey protect your **sign-in to the web console**; the API keys your programs use have their own security practices, covered in [How to securely manage API keys](/en/faq/key-security-management).
</Note>

## Related docs

* [How do I sign in with a Passkey?](/en/faq/passkey-login)
* [How to securely manage API keys?](/en/faq/key-security-management)
* [What if I forgot my password?](/en/faq/forgot-password)
* [How does APIYI keep data secure?](/en/faq/data-security)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.