Recovery and security

GM Markets supports multiple recovery paths so you always have a way back into your account, plus a second-factor confirmation step for non-value-based account controls.

#Recovery paths

• Passkey on a backup device — register a passkey on every device you trust
• Email magic-link — re-authenticate by tapping a one-tap link sent to your email
• TOTP authenticator app — optional, supports Google Authenticator, Authy, 1Password, and any standard TOTP app
• External wallet — if you have linked an external wallet, you can re-auth via that wallet's standard signing flow

You manage recovery methods from Account → Security. We recommend enrolling at least two methods.

#When second-factor confirmation appears

There is no value-based step-up. Deposits, withdrawals, and trades of any size complete with biometric only — no email confirmation tied to dollar amount.

Second-factor confirmation (email magic-link by default, or TOTP if enrolled) is reserved for:

• Private-key export from Account → Security
• New-device sign-in detection
• Suspicious-activity re-authentication (geo jump, device change)
• Session recovery when Privy session lapses mid-flow

#Token + expiry rules

• Magic links and codes are valid for 10 minutes
• Single-use (consumed on first verification)
• Rate-limited: max 5 sends per email per hour
• Bound to the originating session ID — a link issued in browser A cannot be used in browser B unless you explicitly choose "Use a different device"

#What is not used

• SMS OTP is never sent for any flow
• Phone-based authentication is not supported
• Passwords are not used anywhere

This is deliberate: tying a user to a phone number creates a persistent identity hook that contradicts the permissionless positioning. The recovery options above cover every real user.

#If you lose access entirely

If you lose all enrolled devices and recovery methods at once, your wallet is recoverable only through the cryptographic share recovery mechanisms Privy provides — see Account → Security for the current options. Because you can export your private key at any time, the recommended posture is to export it once after sign-up and store the resulting seed phrase the way you would for any self-custody wallet.