Short version: Direct answer: on day one, turn on a passkey or an authenticator app, set an anti-phishing code, enable a withdrawal address whitelist, and audit devices and API keys. Email and SMS codes are the weakest layer in the stack and should never be your only second factor. This is educational content about how the mechanics work — never a trade recommendation.
Two-factor, ranked honestly
OKX lists six authentication methods: login password, email verification, authenticator app, mobile verification, face verification and passkey. They are not equal. Password plus SMS is the combination attackers beat most often, because SMS can be intercepted or SIM-swapped and a password reused from another breach is already public somewhere.
The ranking that matters: passkey first, authenticator app second, email third, SMS last. A passkey uses FIDO2 cryptography bound to your device's biometrics, so there is no code to phish and no shared secret to steal. OKX requires iOS 16 or Android 14 and above for phone-based passkeys, or a FIDO2 USB key on desktop. You can hold up to 10 passkeys on one account, which is generous enough to register a phone and a backup hardware key.
The authenticator app is the practical floor. It is free, works offline, and unlike SMS it does not depend on your carrier. If you are going to do exactly one thing after reading this, bind an authenticator app and print the recovery seed. Not a screenshot in your photo library — paper, in a drawer, or a password manager you actually pay for.
There is one behaviour to know before you experiment: removing a passkey without verifying with another passkey can trigger a 24-hour withdrawal restriction, and a removal that needs extra verification can take up to 24 hours to review. Set up your second passkey before you start deleting the first.
Anti-phishing code and the email layer
Most exchange account takeovers start with an email that looks like the exchange. OKX's answer is an anti-phishing code: you choose a short word or string, and every genuine OKX email carries it. Find it under Security, in the advanced section, and set it once. Then the rule is mechanical — if an email about your account does not show the code, it is not from OKX, no matter how perfect the layout looks.
The code only works if you actually look. Make it a habit for anything involving a withdrawal, a password reset or a "security alert". Attackers rely on urgency: your account is locked, verify now, funds at risk. The code breaks that spell in two seconds.
- Bookmark the exchange URL instead of clicking search results or email links.
- Check the domain character by character on any login page reached from a link.
- Use an email address that is not public, and never reuse its password on an exchange.
- Treat "support" accounts that message you first on Telegram or WhatsApp as hostile by default.
Withdrawal controls, devices and API keys
Withdrawal whitelisting is the highest-value switch after 2FA. Once enabled, coins can only leave to addresses you have already saved, so a stolen session cannot drain the account to a new address. Adding a new address usually comes with a hold period, which is exactly the point — it converts a five-minute theft into a multi-day problem the attacker cannot solve.
Device management is the audit you run monthly. Under account settings and security, OKX shows active devices and login history. Anything you do not recognise gets removed, and then you change the password, because removing a device without rotating credentials fixes nothing.
| Setting | Where it lives | What it blocks | Priority |
|---|---|---|---|
| Passkey or authenticator app | Security → Authentication methods | Credential stuffing and SIM swap | Day one |
| Anti-phishing code | Security → Advanced security | Phishing emails that clone OKX layout | Day one |
| Withdrawal whitelist | Security → Withdrawal settings | Session theft draining to a new address | Day one |
| Device review | Security → Device management | Persisted sessions on old phones | Monthly |
| API key scoping | Profile → API | Over-permissioned bots with withdrawal rights | On creation |
| P2P payment methods | P2P → Profile → Payment methods | Merchants paying into a stranger's account | Monthly |
API keys deserve their own line because they are where experienced users get hurt. Give a bot trade permission only, never withdrawal. Bind it to an IP address if your infrastructure has a fixed one. Delete keys for strategies you stopped running — a forgotten key with trade rights is an open door with no alarm. And rotate the key after any device change.
The recovery plan nobody writes down
Security settings are only half the job. The other half is the answer to one question: if your phone dies tonight, can you get back in tomorrow?
Write down three things and store them offline: the authenticator recovery seed, the backup codes for your email account, and the exact identity documents you used for verification. Losing the authenticator without the seed means a support ticket, a review period and a lot of waiting, often while the market does something you wanted to trade. Losing access to the email address is worse, because every reset path runs through it.
Honestly, the most common failure I see described is not a hack. It is a trader who set up 2FA on a phone that was replaced, never migrated the authenticator, and then discovered the problem during a withdrawal. Two minutes of setup prevents two weeks of ticket threads.
One last rule: never accept help with account recovery from anyone who contacts you. Not a "security team" in Telegram, not a service that promises to reset your 2FA for a fee. OKX support does not message users first and does not need your seed phrase, your password or a remote screen share. Anyone asking for those is the attack, regardless of how the conversation started.
Ready to start trading?
Open a free account on OKX →