Two-Factor Authentication (2FA) Guide
Your PolyBot wallet is controlled through your Telegram-authenticated PolyBot account in the bot and Mini App. 2FA adds a time-based code from a separate authenticator app before sensitive actions.
🔐 Why enable 2FA?
With 2FA on, someone who compromises your Telegram still can't withdraw funds or export your private key without your authenticator code. For any wallet holding meaningful value, this is worth the minor extra step.
🛡️ What it protects
Only the actions that move funds out or expose your keys:
- 💸 Withdrawals — sending funds to an external Polygon address
- 🔑 Private key export — revealing the key that controls your wallet
Trading, deposits, browsing — all unaffected.
⚙️ Setting up 2FA
Requirements
A TOTP-compatible authenticator app: Google Authenticator, Authy, Microsoft Authenticator, or 1Password.
Enable
- Open Settings → Two-Factor Authentication in Telegram, or Mini App → Security Center.
- Tap 🔐 Enable 2FA
- Scan the QR code (or use manual entry key)
- Enter the 6-digit code from your app
- Save your backup codes
Shown only once. Store securely offline.
🔑 Backup codes
One-time recovery codes if you lose your phone or authenticator access.
- Each code works once
- Store securely offline
- Backup message auto-deletes after ~60s
📲 Using 2FA
💸 Withdrawals
- Start withdrawal → enter 6-digit authenticator code → continues
🔑 Private key export
- ⚙️ Settings → 🔑 Export Private Key → enter code → key shown briefly, then auto-deletes
Note: Backup codes are for disabling 2FA, not for withdrawal/export prompts (those expect a live authenticator code).
❌ Disabling 2FA
- ⚙️ Settings → 🔐 Two-Factor Authentication
- Tap ❌ Disable 2FA
- Enter your authenticator code (or a backup code if you lost access)
- Confirm
Only disable when necessary — removes the extra security layer.
🔒 Lockout protection
Too many failed attempts temporarily locks the flow. Wait for the lockout to expire.
🔧 Troubleshooting
Code not working — ensure phone time is synced automatically. Codes expire every 30s. Check you're using the correct account in your app.
Lost authenticator — use a backup code to disable 2FA from ⚙️ Settings, then re-enable to get a new secret + fresh codes. No backup codes left → contact @polybothub.
Backup codes exhausted — disable 2FA with your authenticator code, then re-enable to generate new ones.
💡 Tips
- Use a reputable authenticator app
- Store backup codes offline
- Never share 2FA or backup codes
- Treat 2FA and your private key as separate security layers