Two-Factor Authentication (2FA)
Why enable 2FA
Two-factor authentication (2FA) adds a second layer of protection on top of your Telegram login. Once enabled, sensitive actions on your account require a one-time code from an authenticator app — not just access to your Telegram account.
Why it matters:
TonTrader runs inside Telegram as a Mini App. If someone gains access to your Telegram account, 2FA stops them from withdrawing funds or touching your linked crypto card.
It's a standard security practice on crypto exchanges — enabling it protects your funds and gives you peace of mind.
It specifically reduces the risk of fraud on:
- Withdrawals
- Crypto card deposits (after cards release)
- Logging in from a new, untrusted device
- Viewing your crypto card details (card number, CVV, etc.) (after cards release)
We strongly recommend enabling 2FA right after completing KYC.
How 2FA works, and what you'll need
TonTrader's 2FA is based on TOTP (Time-based One-Time Password, RFC 6238) — the same standard used by Google, GitHub, and most crypto exchanges. It generates a new 6-digit code every 30 seconds.
TOTP works with any standard authenticator app. You'll need to install one before setting up 2FA. Popular options:
Any of these will work — pick whichever you're comfortable with. If you already use one for another service, you can add TonTrader to it too.
In addition to the authenticator app, TonTrader also gives you a recovery code when you set up 2FA. This is a single, one-time code you'll need if you ever lose access to your authenticator app — so save it somewhere safe (a password manager, or written down and stored securely). It's shown to you only once.
How to set up 2FA
Open Settings → 2FA and tap Connect 2FA.
TonTrader shows you a QR code and a text key (with a Copy button) — this is your unique secret.
Open your authenticator app and add a new account:
Easiest: scan the QR code with your phone's camera through the app.
Alternative: choose "enter a setup key manually" in the app and paste the text key.
Your authenticator app will start showing a 6-digit code that refreshes every 30 seconds. Enter that code on the TonTrader screen to confirm the setup.
TonTrader then shows you a recovery code. Save it now — you won't be able to see it again. Confirm you've saved it (checkbox + "I've saved my code" button) to finish.
2FA is now active. By default, it protects all four actions:
Withdrawals
Crypto card deposits
Logging in from a new device
Viewing crypto card details
You can turn protection off for individual actions later in Settings → 2FA, if you prefer — each one has its own toggle (turning a toggle on or off also requires a current code).
If you close the setup screen before confirming you've saved the recovery code, 2FA is not considered connected — you'll need to start over.
What to do when TonTrader asks for a code
Once 2FA is on, you'll be asked for a 6-digit code whenever you:
Withdraw funds
Deposit to your crypto card
Log in from a new device for the first time
View your crypto card details
To confirm:
Open your authenticator app.
Find the entry for TonTrader.
Enter the current 6-digit code shown there into TonTrader.
A few things worth knowing:
Codes refresh every 30 seconds. If yours expires while you're typing, just grab the next one — TonTrader also accepts the previous 30-second code, so you won't get blocked by bad timing.
Wrong code? You'll just be asked to try again
New devices are remembered. Once you confirm a code on a new device, that device is trusted going forward — you won't be asked again on it unless you log out or the trust is reset.
Card viewing has a 1-hour grace period. After you enter a code to view your card details once, you can view them again for the next hour without re-entering a code.
Toggled off an action? If you've turned off protection for something (e.g. deposits) in Settings, no code will be requested for it.
How to recover access if you lose your authenticator app
Lost your phone, reinstalled the app, or switched authenticator apps? Use your recovery code.
On the code-entry screen (or in Settings → 2FA), tap "Lost access to your code? Recover with your recovery code".
Enter your recovery code.
If it's correct, you'll be walked through setting up 2FA again — same steps as section 3: new QR code/key, confirm with a code from your authenticator app, get a new recovery code, confirm you've saved it.
Only once that's fully complete does TonTrader deactivate your old authenticator secret and old recovery code, and activate the new ones. Your protected-action settings (which toggles are on) stay exactly as they were.
If you don't have your recovery code either: tap Contact Support on the recovery screen. This case is handled manually by the support team.
Last updated