Website account flow
The website uses email verification codes for registration, password recovery, and password changes. After login, the navigation bar shows an account avatar and the account menu exposes email, UID, and logout.
- Use an email address you can keep long term
- Do not request repeated codes during the countdown
- Use a unique and sufficiently long password
Exchange connection boundaries
When connecting an exchange account, use a restricted API key and disable withdrawal permission. API keys should be limited to market data, account reads, and the minimum trading execution permissions you actually need.