Security protects Console sign-in and transaction signing, and the page has one section for each. The Sign in section holds your password, sign-in code, passkeys, and active sessions. They protect signing in to the Console itself. The “Approve transactions” section holds your transaction PIN, transaction code, and transaction recovery codes. They protect the signing authority of your Smart Wallet, the wallet the Console uses to authorise the transactions your account submits. You can be signed in and still unable to sign a transaction until one of them is set up.
Open Security the first time you sign, to add a transaction code or a stronger sign-in method, to reset a forgotten PIN, to replace recovery codes that run low, or to end a session on a device you no longer trust. To start, you need a transaction PIN and saved recovery codes. A sign-in code, passkeys and a transaction code are optional.
The “Approve transactions” section with the “Transaction PIN”, “Transaction code” and “Transaction recovery codes” cards.
The page is scrolled below the “Password” card, so only the foot of the Passkeys card with “Add passkey” and the foot of the Sessions card, its rows masked here, show from the Sign in section. In “Approve transactions”, the “Transaction PIN” card reads “Enabled” with Forgot PIN?, “Remove” and “Change PIN”, the “Transaction code” card reads “Not set” with “Set up”, and the “Transaction recovery codes” card reads “Enabled” with “Regenerate recovery codes”. The “Close account” row with “Ask to close my account” follows.
Steps
Set your PIN and save your recovery codes
When the Transaction PIN card shows “Not set”, select Set PIN. The “Signing setup” wizard opens:
- At “Set your transaction PIN”, enter a 6-digit PIN in PIN and again in “Confirm PIN”. When your account already holds another wallet factor, the wizard then asks you to confirm it is you with that factor under “Confirm it is you”.
- At “Back up your transaction recovery codes”, the wizard shows 16 recovery codes. Each code is two groups of five letters and digits. Use “Copy all” or “Download” to store them, tick “I have stored these recovery codes in a safe place”, then select Finish setup.
The set counts only after you confirm it. If you close the wizard before the end, it asks “Close setup?”, and signing stays blocked until you finish.
When you already hold a transaction code and confirmed recovery codes, Set PIN does not open the wizard. It asks for the new PIN twice, then for your transaction code or a recovery code under “Confirm the new PIN”.
Change your password
On the Password card at the top of the “Sign in” section, enter your “Current password”, enter the new password in “New password” and again in “Confirm password”, then select “Save”. The new password must meet your deployment's password rules, by default at least 12 characters from three of the four character types, and it cannot repeat a recent password. When the platform refuses a password, the message names the rule it broke.
Set up a sign-in code, or add a passkey
On the Sign-in code card, select Set up, enter your password, scan the QR code with your authenticator app, and enter the code it shows. The Console then shows sign-in backup codes and asks you to tick “I have saved my backup codes” before you can finish.
On a deployment that requires a sign-in code, the Console sends you to a setup page for it before any other page opens, and the page says the code is required. Where the code is optional, the same page says so.
To add a passkey instead, or as well, select Add passkey and follow your device's prompt.
You can remove either sign-in method. Select Remove on the Sign-in code card and enter your password to turn it off. To remove a passkey, select “Delete passkey” on its row and confirm. That passkey can no longer sign you in, and your other sign-in methods keep working.
Review your sessions
The Sessions card in the “Sign in” section lists the devices where you are signed in, and marks the one you are using with a “Current session” badge. Select “Revoke session” on a row and confirm to sign that device out. The Console reports “Session revoked. That device is signed out.” Select “Revoke other sessions” and confirm to sign out every device except this one. The card says “You have no other active sessions.” when there is nothing to revoke. The current session has no revoke control, so end it by signing out.
A session a platform administrator opens by impersonating you shows on this card too, with the line “Opened by <name>, a platform administrator” under it. Revoke it like any other session to end the administrator's access.
Add a transaction code
A transaction code is a code from an authenticator app, 6 digits by default, that approves a transaction in place of your PIN. Select Set up on the Transaction code card, and confirm with your transaction PIN or a recovery code when the Console asks. Scan the QR code with your authenticator app, or enter the key shown under it, then enter the code the app shows and select “Turn on”. By default the app lists the entry as “DALP transactions”. Your sign-in code, if you have one, is the separate “DALP” entry.
From now on, the dialog that confirms a transaction asks for your transaction code first. Adding it starts your organisation's cooling-off period unless it is your first way to approve transactions, as What happens after a wallet security change explains.
Remove your PIN or transaction code
You can remove your transaction PIN or your transaction code, but always keep one of them, because without either one your wallet cannot approve a transaction. Select Remove on the card and confirm in the dialog that opens. Removing the PIN asks for your transaction code, your transaction PIN or a recovery code. Removing the transaction code asks for your transaction code or a recovery code. Removing either starts the cooling-off period.
When that item is your only way to approve transactions, “Remove” opens a short prompt instead: “Add another way to approve transactions first”. Select “Set up transaction code” or “Set PIN” in the prompt to add the other item right there, then select “Remove” again.
Regenerate your recovery codes
To replace the set, select Regenerate recovery codes and confirm with your strongest method, as What confirms each change lists. Store the new codes, tick “I have stored these recovery codes in a safe place”, then select “Continue”. Until you confirm, the previous set keeps working, so closing the dialog before that leaves your old codes in place. Once you confirm, every old code stops working, unused ones included. Showing the new set sends the security change email and starts the cooling-off period when one applies, and closing the dialog does not undo the hold.
Reset a forgotten PIN
Select Forgot PIN? on the Transaction PIN card or inside the verification dialog. Enter the new PIN twice, then one unused recovery code under “Confirm with a recovery code”. With no recovery code left, select “Forgot PIN?” on the Transaction PIN card, and your transaction code confirms the new PIN. In that case the verification dialog sends you to the Security page. After a reset inside the verification dialog, the Console offers “Sign transaction” to finish the action with the new PIN.
A reset spends the code it used. When that was your last unused code, the platform replaces the set in the same step. The Console never shows the new codes, so you cannot use them. After a reset from the Transaction PIN card, the setup wizard opens at its recovery-code step straight away. After a reset in the verification dialog, it opens the next time you sign. Until you save and confirm a set, you have no recovery codes you can use.
Ask to close your account
The Security page ends with one row, “Close account”. Select Ask to close my account to open a side panel with the steps to close it: empty your wallets, give each organisation another owner, and hand over your checker duties. Each step reads done or says what is left to do. The last step asks an administrator to close your account. Open steps do not stop you from asking. They tell you, and the administrator, what still has to happen before the account can be closed. When an on-chain identity is bound to your account, the last step says its record stays once it is closed, because an identity cannot be removed.
Confirm with your password and type your email. When your account signs in through single sign-on, confirm with wallet verification instead: your transaction PIN, your transaction code or an identity provider code. Select Send request. The side panel then shows the request waiting for an administrator, and you can select “Withdraw request” until an administrator acts. Once you close the panel, the row says when you asked, and “View request” opens the panel again.
An administrator closes the account once no step is left, or keeps it and tells you why. Closing ends sign-in and every session, and when an on-chain identity is bound to the account its record stays. It also stops the account's API keys for good. A closed account stays closed: signing in says “This account is closed.”, and the password field stays empty until you enter another email. You receive an email at every step, and a declined request shows the reason on this page.
Which second factor finishes sign-in
With a sign-in code set up, Console sign-in opens Sign-in code and asks for the code from your authenticator app. “Forgot authenticator?” switches to one of your backup codes. “Trust this device” lets that browser skip the code on later sign-ins, and the trust lapses after 30 days.
Codes sent by email or text message do not finish Console sign-in. They belong to the Investor portal, where an investor can choose how to receive a code when their organisations allow it. Sign-in codes for the Investor portal covers the codes and the organisation setting that offers them.
Your organisations decide which methods sign-in accepts. When an organisation you belong to stops allowing the authenticator app, Console sign-in refuses your authenticator and backup codes with TWO_, and a device you trusted loses that trust. Ask an owner of that organisation to allow the authenticator app again, because no other code finishes Console sign-in.
Wallet verification
The platform asks for a second proof at the moment you sign, on top of your signed-in session. A session left open on a shared desk, or a stolen session cookie, is then not enough to move an asset, mint a token or change custody from the Console. An API key with Read & Write scope is enough, because API key requests are not asked for wallet verification. The proof is separate from the sign-in code that finishes sign-in.
The methods
The verification dialog offers the methods your account holds:
The dialog selects your transaction code by default when you hold one, then an identity provider authenticator, and your transaction PIN otherwise. When you hold more than one method, buttons at the top of the dialog switch between them. A code is accepted once: a replayed transaction code, or a spent recovery code, is refused.
When the Console asks for it
The Console opens the verification dialog before every action your wallet signs, such as a transfer, a mint or a custody change. It also asks before actions that change your security or create access: creating an API key, changing its scope or expiration, or turning it back on, changing or removing your PIN, adding or removing your transaction code, regenerating your recovery codes, and, under single sign-on, asking to close your account. Integrations that call the API with an API key send no verification. While the key's owner is in a cooling-off period, every request of theirs that signs a transaction returns 403 WALLET_VERIFICATION_HELD until it ends, and reads keep working.
If you hold neither a transaction PIN nor a transaction code, or your recovery codes are missing, the dialog opens the setup wizard instead of the prompt. When the wizard finishes, the Console returns you to the action. If you close the wizard, the dialog shows “Finish setting up your PIN and recovery codes before you sign.” with Continue setup.
Some actions refuse your PIN once you hold a transaction code: regenerating recovery codes, creating, changing or re-enabling an API key, and shortening your organisation's cooling-off period, the wait after a security change during which signing is on hold. API key changes also refuse it while you hold an identity provider authenticator. For recovery codes and API keys, the dialog hides the PIN when you hold a transaction code or an identity provider authenticator.
If a PIN still reaches the platform while you hold a transaction code, for example from a script that calls the API with your signed-in session and a walletVerification body, the platform refuses the regeneration with “Regenerating recovery codes needs your transaction code or a recovery code.” A recovery code is still accepted.
Changing an API key refuses both a PIN and a recovery code while you hold a transaction code or an identity provider authenticator. The dialog that shortens the cooling-off period still offers your PIN, but when you hold a transaction code the platform refuses it and saves nothing, so confirm again with your transaction code.
One verification authorises one request
A verification from your Console session is bound to the one request you confirmed. Before it sends a signing request, the Console asks the platform for a challenge that names the action, its target and a digest of what you are about to send. The platform spends that challenge once, and it expires after 5 minutes. A verification captured on its way to the platform therefore cannot authorise any other request. Someone who holds both your session and your PIN can still start a new request, which is what the lockout, the change emails and the cooling-off period are for. When a challenge has expired, confirm the action again.
Lockout after wrong codes
Wrong PINs, recovery codes, transaction codes and codes the identity provider rejects share one count and one lock. After a wrong code, the dialog names the factor it checked, for example “That PIN is not correct.”, with the attempts left before verification locks. After five wrong codes, the next attempt starts a 15-minute lock without checking its code, and the dialog says “Too many failed attempts. Try again in” the number of seconds left. Every method is locked until the lock ends.
Attempts more than 15 minutes apart start a fresh count, and a successful verification clears it. A failure that is not a wrong code does not count. When the platform cannot reach the identity provider or the credential store, the dialog says “Verification is temporarily unavailable. Try again shortly.” or “Verification is busy right now. Try again shortly.”, and your attempts are not used.
Recovery codes
A set of 16 recovery codes lets you reset a forgotten PIN without the old PIN or your password. Each code works once.
- The Transaction recovery codes card shows how many codes remain. It warns “You are running low on recovery codes. Regenerate a fresh set so you can still reset your PIN if you forget it.” when one or two remain, and “You have no recovery codes left. Regenerate a fresh set to restore PIN recovery.” when none remain.
No Console screen or API route shows or sets your PIN or recovery codes for you. An identity manager in an organisation you belong to can reset your transaction PIN, remove your sign-in code, end your sessions in that organisation and send you a password reset link. A PIN reset also signs you out on every device in every organisation and starts a cooling-off period, and you set a new PIN before you sign again. Through an API key, the identity manager is not asked for wallet verification. A second approver confirms these changes only when your organisation protects the System administration group under Approvals.
What confirms each change
Changes to how you approve transactions never accept your account password. A dialog offers a recovery code only while you have an unused one.
Keep at least one unused recovery code somewhere safe before you need it.
What happens after a wallet security change
Every change to how you approve transactions sends you an email: a transaction PIN set, changed, removed or reset, a transaction code added or removed, or recovery codes regenerated. The email says what changed, when, and from which browser, operating system and network address. If that was not you, sign out of all sessions, change your password, and tell your organisation's administrator. When an identity manager resets your transaction PIN, the email says so.
When the change alters or removes a transaction PIN or transaction code you already held, adds a second one, or replaces recovery codes you had confirmed, it also starts a cooling-off period. The period is 24 hours unless your organisation set another length on General. If you belong to several organisations, the longest of their periods applies, whichever organisation you work in, and you can leave an organisation only once your hold ends. While the hold lasts, the verification dialog refuses every signing request with “Your wallet security settings changed recently, so signing is on hold until” the end time, and the email names the same time. Your API keys can still read, but cannot sign, for the same period, and no new key can be created.
Setting up your first transaction PIN and recovery codes sends the email but starts no hold. Setting up a transaction PIN or transaction code again after an identity manager reset your PIN starts a new hold, even when the PIN was your only way to approve transactions. Under single sign-on, adding or removing the authenticator app you use at the identity provider counts as a change too, from the moment the platform next asks the provider. The first time the platform asks, an authenticator you already had there starts no hold, and it sends no email when you already hold a transaction PIN, transaction code or recovery codes. When it is your only way to approve transactions, you get the security email.
When the cooling-off period is 0, nothing is held and the emails say nothing about a hold, but every change is still emailed. When your hold ends, you get one email saying so. If your organisation changes the period and that moves the end of your hold, you get one email with the new end.
Troubleshooting
Changing my password shows Request failed
The platform turns off your API keys before it stores the new password. When it cannot reach the key store, it refuses the change, keeps your old password and leaves your keys as they were. Your old password still works. Try the change again in a moment. If an identity provider manages your password, follow that provider's reset process and review Console API keys separately.
I was asked to set up a PIN in the middle of signing
The Console opens the setup wizard in place of the verification prompt whenever you hold neither a transaction PIN nor a transaction code, or your confirmed recovery codes are missing. Finish the wizard, including the recovery-code confirmation, and the Console returns you to the action.
I forgot my PIN
Select Forgot PIN? on the Transaction PIN card or in the verification dialog. Set a new PIN, then enter one unused recovery code. If that code was your last one, the setup wizard opens to save a new set: straight away after a reset from the Transaction PIN card, or at your next signing action after a reset in the verification dialog. With no recovery code left, your transaction code confirms the new PIN. With neither, ask an identity manager in your organisation to reset your transaction PIN.
I have run out of recovery codes and cannot reset my PIN
A reset needs an unused recovery code or your transaction code. Regenerate a fresh set from the Transaction recovery codes card while you still can, because regenerating asks for your transaction code once you have one, and your transaction PIN until then. Under single sign-on with an identity provider authenticator and no transaction code, it asks for your identity provider code instead.
Remove asks me to add another way to approve transactions first
The Console keeps one way to approve transactions on your account. When the item you remove is your only one, set up the other item from the prompt, then select Remove again.
The PIN card says my PIN setup did not finish
This happens when your first PIN setup stopped before it ended. If you sign in with an email and a password, select Set PIN and enter the same PIN you chose the first time. That finishes the setup. If you sign in through your organisation's identity provider, select “Replace PIN” on the Transaction PIN card and set a new PIN. The Console accepts the new PIN only in the first 5 minutes after you sign in. After that, the card says “Sign in again to replace your PIN.” Select “Sign in again”, sign in, and the PIN setup opens. If you already have a transaction code or saved recovery codes, “Set PIN” asks for one of them, and the new PIN replaces the one that did not finish. If you do not remember the first PIN and hold neither, ask an identity manager in your organisation for help.
Verification is locked
After five wrong codes, the next attempt starts a 15-minute lock on every wallet verification method without checking its code. The dialog shows the seconds left. Wait for the lock to end, then try again with the right code. A wrong code from any method counts towards the same lock.
Signing is on hold after a security change
Your organisation's cooling-off period starts when you change a transaction PIN, transaction code or confirmed recovery codes you already held, when you add a second one, or when you set one up again after an identity manager reset your PIN. The dialog and the change email name the time the hold ends. Signing works again after that time. If you did not make the change, tell your organisation's administrator at once.
I cannot revoke my current session
The session you are using is marked “Current session” and has no revoke control of its own. Sign out to end it. Use the sessions card to revoke other devices one at a time or all other sessions at once. Each revoke asks you to confirm first, and cancelling leaves every session as it was. A session revoked or deleted elsewhere stops working everywhere, and an expired session cannot sign you in. Sign in again to continue.
The sessions list does not load
When your sign-in is not recent enough for a sensitive read like this, the sessions card asks you to sign in again instead of showing a partial list. Sign in again and the list loads.