Account security
The whole Security screen: changing your password, two-step verification, SMS number and passkeys. What each notice at the top means.
Last updated: September 30, 2026
Loading…
The whole Security screen: changing your password, two-step verification, SMS number and passkeys. What each notice at the top means.
Last updated: September 30, 2026
Whoever gets into the panel sees your customer list, your conversations and your accounts' connection settings. My user settings › Security keeps every tool for protecting that entrance in one place: password, two-step verification, SMS number and passkeys. This guide covers the four sections and the notices that can appear at the top.
💡 This screen belongs to your user account, not to a portfolio. It needs no permission and opens even when your portfolios are locked for deletion. While our support team is viewing the panel as you to help you, nothing here can be changed.
The screen serves three purposes:
One or two info boxes may appear at the very top, depending on your situation. Which one you see tells you what to do.
Amber warning — you have no extra protection. "We recommend turning on two-step verification to protect your user account. It isn't compulsory; with it on, nobody can sign in even if your password is stolen." If you see this box, your account is protected by a password alone.
Blue info — you have a passkey but no two-step verification. "Your passkey is registered; you can sign in with it. Because password sign-in is still open, turning on two-step verification completes the protection." That is a reminder that a passkey does not remove the password: as long as the password route is open, two-step verification still adds protection.
Blue info — your phone is verified but two-step verification is off. "Your phone is verified. An SMS code is only used as a sign-in method while two-step verification is on." So verifying a number is not protection on its own; until you enable two-step verification, the SMS code is not used on the sign-in path.
With two-step verification on, none of these notices appears.
The screen's first section, with three elements: Current password, New password and the Change password button.
The new password has one rule, printed under the field: at least 10 characters.
The steps:
Get the current password wrong and the panel says "Current password is incorrect." and makes no change.
If you signed up with Facebook or Google you never had one. In that case the section shows an info box instead of a form: "You signed up with Facebook or Google; set a password with Forgot password first to use password features."
What to do is sign out and use the Forgot password route on the sign-in screen. The link that reaches your e-mail lets you set a password; after that this section works normally.
The second section. Its description: "At sign-in, asks for the code from your authenticator app in addition to your password." A badge next to the heading reads On or Off.
The whole of this section — turning it on, scanning the QR code, backup codes, re-setup and turning it off — has its own guide: Two-step verification.
In short: to turn it on you enter your password, scan the code on screen with an authenticator app, then type the app's 6-digit code. Once on, the panel gives you backup codes; save them somewhere safe because they are never shown again.
While it is on, three more actions appear in the section:
The third section. Its description: "You can receive a sign-in code by SMS on your verified number (an alternative route in two-step verification)."
To add a number:
Once verified, a Verified badge appears next to the number. To remove it, press Remove number; the panel asks for confirmation.
To change the number, type a new one into New number and repeat the same steps.
⚠️ If SMS sending isn't enabled on the platform, the section reads "SMS sending isn't available on the platform yet." and you cannot add a number. That is not your setting; it is a platform-wide feature.
Verifying a number is not protection on its own. An SMS code is used as a sign-in route only while two-step verification is on; the screen says so in an info box.
The fourth section. Its description: "Sign in without a password or a code using Face ID, your fingerprint or your device lock. The key is stored on your device and shared with nobody."
The whole of this section has its own guide: Passkeys.
In short: you press Add a passkey to this device, verify your identity first, then your device takes over. Each key you add appears in the list with its name, the date it was added and whether it syncs across devices.
If passkeys are disabled on the platform, this section isn't drawn at all.
There are three protection routes and you can enable them all. Practical advice:
Not saving the backup codes. They are shown once when two-step verification is enabled; if you lose your phone they are your only route.
Assuming a passkey replaces the password. Password sign-in stays open; the screen says so in an info box.
Verifying a number and assuming you are protected. SMS is a sign-in route only while two-step verification is on.
Signing up with a social login and looking for the password field. You have to set a password with Forgot password first.
Trying to open the Connection screen with no method enabled. The panel sends you here; see The security verification screen.
For detailed setup see the Two-step verification and Passkeys guides. For where these methods are demanded see The security verification screen.
Was this article helpful?