Two-factor authentication (2FA)
Two-factor adds an authenticator-app code (TOTP - the same 6-digit codes Google Authenticator, 1Password, or Authy generate) in front of your most sensitive actions. It is separate from your wallet signature: even someone holding your session cannot change your limits or move money into DeFi without the live code.
What 2FA protects
You can turn 2FA on for three independent gates:
| Gate | What it protects |
|---|---|
| Login | Signing in to your account. |
| DeFi | Signing any DeFi action (supply / withdraw / borrow / repay). Required for DeFi once enabled. |
| Limit changes | Changing your agent's on-chain spending limit. |
When a gate is on and you (or an agent) trigger that action, XDC AI asks for a code before the wallet signature. Enter the 6-digit code, and it opens a short-lived "step-up" grant so you are not asked again for every micro-action in that window.
:::note DeFi requires 2FA Because DeFi actions move funds, two-factor is mandatory for DeFi signing. If you have not enrolled, the app prompts you to set it up first. :::
:::tip Required before adding a key 2FA is also the prerequisite for hardening your wallet with more keys. You must have it on before you can link an external wallet or add a passkey - see Signers & recovery. :::
Enable it
- Go to xdcai.tech/account/security.
- Scan the QR code with any authenticator app (or paste the secret).
- Enter a code to confirm enrollment. You will be shown one-time recovery codes - save them somewhere safe. They are the only way back in if you lose your authenticator.
- Toggle which gates you want (login / DeFi / limit changes).
How the prompt works
When a gated action runs - for example, saving a new spending limit or signing a DeFi supply - a two-factor popup appears:
- Enter the current 6-digit code from your authenticator app.
- The code is verified and a short grant opens.
- You then sign the action with your wallet.
The order is always 2FA code, then wallet signature. If a code is wrong, the popup stays open so you can retry.
Lost your authenticator?
Enter one of your saved recovery codes in the same prompt instead of a live code. Each recovery code works once. If you run out, disable and re-enroll 2FA from the Security tab.
For agents
Two-factor is a browser-side step - agents never see or handle the code. When an agent triggers a gated action (a spending-limit change, or a DeFi propose the user then signs), the user completes the 2FA prompt themselves in the browser. If you are an agent and a limit or DeFi action returns a "two-factor verification required" response, tell the user to complete the prompt in their browser; there is nothing for you to pass through.
Example prompts
- "Turn on two-factor authentication for my account."
- "Require 2FA before changing my spending limit."
- "Set my limit to 50 USDC per day." (the browser asks for your 2FA code, then you sign)