Security Settings

Open Security settings

​

Two-factor authentication

MyFundedPerps starts sign-in with a one-time code sent to your email. When you have a passkey or authenticator app enabled, you must then verify one of those methods. If both are enabled, you can choose either method at sign-in. All staff roles, including support, compliance, admin, and superadmin, must set up at least one method before using admin tools. Opening the admin area without a method shows a required setup dialog. It cannot be dismissed; complete setup or sign out. Staff enrollment does not require customer onboarding. Staff cannot remove their final method: add another method first. To change another user’s role, open that user from the admin user directory and select Change Role under Account Actions. Choose the new role, then verify with your passkey or an existing authenticator app. Each role change requires a fresh verification, valid for five minutes and usable once. Your staff permissions still determine which roles you can assign; you cannot change your own role. Sign-in-as-user, trading restrictions, and ban controls also live on the user detail page. You can request up to five codes per rolling minute and ten per rolling hour for the same email address. If you reach either limit, the code request control remains unavailable while an inline message counts down until you can request another code. Passkeys use your device’s biometric check, PIN, or security key PIN. MyFundedPerps does not receive that biometric or PIN.

​

Resume or restart sign-in

If you return after verifying your email but before completing two-factor verification, MyFundedPerps can resume the unfinished sign-in. You are not fully signed in until you verify your second factor. Authenticator verification must finish within 10 minutes of verifying your email. If that window has expired and you have no passkey to use instead, reopening sign-in returns you to email entry. If it expires while you are entering an authenticator code, submitting the code returns you to email entry with an expiration message. Request and verify a new email code to continue. Select Use Different Email to clear the unfinished session and start again. If that request fails, the verification screen stays open and shows an error. Try Use Different Email again when your connection is available.

​

Add a passkey

1. Select Add Passkey.
2. Follow the prompt from your device, password manager, or security key.
3. Confirm that the passkey appears in Security settings.

If your current session is no longer recent, sign out and sign in again, then return to Security settings within 10 minutes to add the passkey. Adding your first passkey enables two-factor authentication on every future sign-in. Add more than one passkey if you want a recovery option on another device or security key. You can keep up to 10 passkeys on your account.

​

Remove a passkey

Select Remove beside a passkey and confirm. Removing your final passkey leaves authenticator-app verification enabled if you have it. Customers who remove their final method turn off two-factor authentication; staff must keep at least one method.

​

Add an authenticator app

1. Select Add Authenticator App.
2. Scan the QR code with your authenticator app, or enter the setup key manually.
3. Enter the app’s six-digit Authenticator Code and select Verify Code.

Setup is complete only after the code is verified. Authenticator apps generate a new code every 30 seconds. A code can be used only once. Start a new setup if you do not finish within 10 minutes. When you sign in with both methods enabled, select Use Authenticator App to enter a code instead of using your passkey. Authenticator setup, verification, and removal share a limit of five requests per minute per account. If you reach it, wait a minute before trying again. A new sign-in does not reset the limit.

​

Remove an authenticator app

Select Remove Authenticator App in Security settings and confirm. You may need to sign out and sign in again before changing your methods. Staff must have a passkey before removing their authenticator app.