IDENTITY
Sensitive actions demand fresh proof. Strange network behaviour shrinks trust automatically. API keys carry only the rights you grant — and signing, not secrets, proves who calls.
The legacy identity stack ran on an end-of-life server with HMAC-based, symmetric 2FA. The new contour is a modern IdP — OIDC with PKCE — with phishing-resistant passkeys and a perimeter that asks for proof exactly where it matters.
Legacy · before
Now · in build
A passkey ties your login to this device and this origin, so a look-alike site has nothing to phish. TOTP stays available as the baseline second factor.
01 · Passkeys (WebAuthn)
A passkey is a device-bound key pair scoped to the real origin. It never leaves your device and never travels to a server, so a phishing page cannot capture or replay it — there is no shared secret to steal.
Mechanism: WebAuthn origin-bound key pair, no shared secret.
02 · TOTP baseline
Time-based one-time codes (TOTP) remain available as the baseline second factor for any authenticator app, so strong 2FA does not depend on owning a passkey-capable device.
Mechanism: TOTP second factor over a modern OIDC + PKCE flow.
Step-up is a perimeter, not a constant nag. Boundary actions — moving funds, changing a whitelist, issuing a key, changing 2FA — demand fresh, strong proof. Ordinary trading inside your session does not keep interrupting you.
Gated · fresh proof
Step-up: fresh strong proof (RFC 9470).
Not gated · stays fluid
Inside the session — no repeated 2FA.
A session is not a fixed-length pass. When the signals around it look anomalous, the window of trust contracts and re-authentication comes sooner.
01 · Signals
Unusual signals — a sudden cross-IP jump, an unfamiliar network, an improbable location change — are read as risk. The riskier the context, the shorter the session is trusted before it asks you to re-authenticate.
Mechanism: risk score → reduced session trust window.
02 · Cross-IP example
If a live session suddenly appears from a different network or country, that is treated as an anomaly: the trust window is cut short and the next sensitive action re-prompts earlier than it otherwise would.
Mechanism: cross-IP anomaly → earlier re-authentication.
API keys are scoped — read, trade, and withdraw are separate permissions. Requests are signed with Ed25519 rather than carrying a bearer secret, and withdraw-scoped keys only work against whitelisted addresses.
| Scope | Grants | Auth | Destination |
|---|---|---|---|
| read | Read balances, orders, and market data. Nothing that moves value. | Ed25519-signed | — |
| trade | Place and cancel orders. Cannot withdraw or change settings. | Ed25519-signed | — |
| withdraw | Request withdrawals only — and only to addresses you have whitelisted. | Ed25519-signed | Whitelist-only |
IP allowlisting can be attached to any key. Requests are signed, so a leaked key is not a usable bearer token on its own.
How login, sessions, and keys actually behave — the parts worth understanding before you connect an app or move funds.
A passkey is a device-bound key pair created for a specific origin. The private half never leaves your device and is only usable on the real site, so a look-alike phishing page has nothing to capture and nothing to replay — there is no shared secret or code to steal. That is what makes it phishing-resistant where a one-time code is not.
No. Step-up is a perimeter model, not a per-action prompt. Ordinary trading inside your authenticated session runs without interruption. Fresh proof is required only for boundary actions — withdrawals, whitelist changes, issuing API keys, or changing your second factor.
Nothing that moves money. A read-scoped key can only read balances, orders, and market data — it cannot place trades, change settings, or withdraw. Scopes are separate permissions, so a leaked read key never gains write or withdrawal power, and requests are signed rather than relying on the key as a bearer secret.
Anomalous signals around the session — a sudden cross-IP or cross-country jump, an unfamiliar network, an improbable change in context. When the risk score rises, the session's trust window contracts and the next sensitive action asks you to re-authenticate earlier than it otherwise would.
Identity guards who may ask to move money; custody holds it under a threshold signature, and transparency lets you check the books behind both.