Keeping your account secure
Use a password you do not use anywhere else, turn on two-factor authentication in account settings, and revoke any session you do not recognise. API keys can spend your wallet balance, so keep them on your server and revoke any key that is exposed. Support never needs your password or codes.
Password
Passwords must be at least 12 characters. Use a password manager and a password that is unique to Boostsy. Change it in Settings if you suspect it has been seen.
Two-factor authentication
- Open Settings, then Security.
- Choose Set up authenticator and scan the code with an authenticator app.
- Enter the six-digit code to confirm.
From then on, sign-in asks for a code from the app. Keep the setup key somewhere safe in case you change phones.
Sessions
Settings lists the devices currently signed in. Revoke any you do not recognise, then change your password.
Verify your email address so that password resets and order notifications reach you. If you change your email, the new address must be verified.
API keys
- A key can place orders using your wallet. Treat it like a password.
- Store keys on a server, never in browser code or a public repository.
- Use a separate key for each integration and revoke unused keys.
- Revoke immediately if a key is exposed.
Social accounts
Boostsy never asks for the password to your Instagram, TikTok, YouTube or other social accounts. Orders use public links only. If anyone claiming to be Boostsy asks for a social password, do not give it.