Security

Two-factor authentication (recommended): in the dashboard open Settings → Security, confirm your password, scan the QR code with Google Authenticator (or any TOTP app: Microsoft Authenticator, 1Password, Authy), and enter the 6-digit code. From then on every dashboard sign-in asks for a code after your password. Codes change every 30 seconds and each code works once.

Recovery codes: when you turn on 2FA you get 10 one-time recovery codes, shown once. Store them offline. Each one replaces a code at sign-in if you lose your phone. You can generate new ones (password plus a current code) from Settings → Security.

Turning 2FA off or moving to a new phone needs your password and a current code. If you lost both your phone and your recovery codes, contact Zenvault support; after verifying your identity an admin can reset 2FA, which also signs you out everywhere.

2FA protects dashboard sign-in only. API keys keep working without a code, so keep them on your server and revoke any key that may have leaked.

Keep API keys and webhook secrets on a server. Verify signatures. Use HTTPS webhook URLs in live mode. Test mode may deliver to localhost. Do not trust a transaction hash supplied by a payer. Validate the network and asset from the invoice response, not from a wallet label.