The very first thing to do right after registering your OKX account: set up Google Authenticator (2FA) first, then configure Passkey later. 2FA is the final hard defense line for your account, while Passkey is only a convenient shortcut for daily use — you should prioritize features by security strength, not how new they are.
Why follow this order
One-time verification codes generated by Google Authenticator are stored locally on your phone, which is far more secure than SMS codes. SMS codes can be intercepted easily via SIM hijacking, carrier interface vulnerabilities and other attack methods. While Passkey is more secure than traditional passwords, it essentially relies on your device's biometric data, which brings risks if your device is lost or sync fails.
Also, OKX Passkey has a key restriction: when you bind Passkey for the first time, you must first complete identity verification, email verification and phone verification. That means you cannot enable Passkey alone without any 2FA setup — it is built on top of your existing account security system.
Step 1: Bind Google Authenticator (Mandatory)
[What to do] Link your OKX account to Google Authenticator as your top priority verification method. [How to do] Open the OKX App → tap the profile icon on the top left → go to Security Settings → find "Google Authenticator" → follow the prompts to scan the QR code to finish binding. During setup, the system will give you a string of recovery keys, write this down on paper and store it safely, do not take a screenshot and save it on your phone. [Completion check] The Security Settings page shows "Google Authenticator Enabled", and you can use the Google Authenticator dynamic code to verify successfully after logging out.
Risk Reminder: After the OKX user security incident in June 2024, OKX has upgraded its security policies. But you still need to note: For sensitive operations including withdrawals, adding whitelists and modifying security settings, use Google Authenticator verification first, avoid downgrading to SMS verification. Make sure to copy the recovery key on physical paper, you can only recover access if your phone is lost with this key.
Step 2: Set Up Anti-Phishing Code (Prevent Phishing Attacks)
[What to do] Set a unique code only you know, this code will be attached to every official email OKX sends you. [How to do] Go to Security Settings → "Anti-Phishing Code" → enter a unique string of characters (mix of letters and numbers) then save it. [Completion check] You will see this custom code in the body of all official OKX emails, mark any email without this code as a scam immediately.
Step 3: Enable Withdrawal Whitelist
[What to do] Restrict withdrawals only to pre-specified wallet addresses, you have to add a new address to the whitelist before you can withdraw funds to it. [How to do] Go to Security Settings → "Withdrawal Address Management" → turn on the whitelist feature, then add all your frequently used wallet addresses. Note: Adding a new withdrawal address may trigger a 24-hour holding period, during which you cannot make any withdrawals. [Completion check] The withdrawal page only shows addresses you added to the whitelist, you cannot manually enter any other random address.
Step 4: Set Up Passkey (For Convenience)
[What to do] Configure Passkey as your fast login method. [How to do] Go to Security Settings → "Passkeys" → enable it → follow the prompts to finish device verification. One OKX account supports up to 10 Passkeys. [Completion check] You can log into your account directly with Face ID or fingerprint, no need to enter passwords or verification codes.
Common Setup Failure Reasons
You bound Google Authenticator but did not save the recovery key, you cannot restore access to GA if your phone is lost, and have to go through customer support to reset it.
You only enabled SMS verification without setting up Google Authenticator, your account security level is far too low.
You turned on the whitelist but tried to add a new address last minute, and get stuck in the 24-hour holding period unable to withdraw funds.
Next Steps
Finish setting up Google Authenticator and anti-phishing code in this order first, then write down your recovery key and store it in a safe place. If you find entering verification codes every time for daily login too troublesome, you can set up Passkey later. After all steps are done, log out of your account and log back in once, go through the full verification flow with Google Authenticator to confirm every feature works properly.
