Security

Yeld prioritizes security with a non-custodial model and multiple security features.

**Security Principles:**
- Your private keys never leave your server
- All sensitive operations require proper authentication
- We follow industry best practices for cryptography

Enable 2FA to add an extra layer of security to your account.

**Setup 2FA:**
1. Navigate to Settings → Security
2. Click "Enable Two-Factor Authentication"
3. Scan the QR code with your authenticator app
4. Enter the verification code
5. Save your backup codes

Manage your API keys for programmatic access.

**Create API Key:**
```typescript
await createApiKey({
  name: "Production API Key",
  permissions: ["read", "write"],
  expiresIn: "365d",  // Optional expiration
});
```

**Rotate API Keys:**
- Generate new keys regularly
- Revoke old keys after migration
- Never share API keys in code or logs

**Do's:**
- ✅ Use strong, unique passwords
- ✅ Enable 2FA on all accounts
- ✅ Store secrets in environment variables
- ✅ Rotate API keys periodically
- ✅ Monitor account activity regularly
- ✅ Keep your server secure

**Don'ts:**
- ❌ Never share your master mnemonic
- ❌ Never commit secrets to version control
- ❌ Never use API keys in client-side code
- ❌ Never share backup codes

Yeld monitors for suspicious activity and sends alerts.

**Alerts Include:**
- New login from unknown device
- API key created or revoked
- Large transaction attempted
- Failed login attempts
- Password change

**Configure Alert Preferences:**
Choose which alerts you want to receive via email or webhook.