Skip to main content
This page covers what protects your account, what you control, and how to report a security issue.

​
Two-step verification

Turn it on. Two-step verification sends a one-time code to the email address on your account. Turn it on in your account settings. Once it is on, signing in asks for that code, and withdrawals can ask for it too. A withdrawal can also require confirmation from a link MagicMarkets emails you, or both steps together. See Withdrawals. Your email account is the key. Sign-in codes go to the email address on your account, so protect that mailbox with its own strong password and its provider’s two-step verification. If you sign in with Google, protect your Google account the same way. If you lose access to your email, contact support and expect identity checks.

​
Sign-in options

Choose one you can keep control of. An email account you no longer read is a weak point, because it is the recovery path for everything else.

​
Your email and Google passwords

You sign in to MagicMarkets through your email or your Google account, so their passwords protect your MagicMarkets account. Give each one a unique password, generated and stored by a password manager.

​
API keys

An API key can trade your balance. It cannot withdraw. The public API has no endpoint to deposit, withdraw, change a withdrawal address or manage API keys: all of that happens on the website, behind your sign-in and two-step verification. Treat a key like a password all the same:
  • Never commit a key to a repository or paste it into a chat, an issue or a screenshot.
  • Keep it in an environment variable or a secret store.
  • Use separate keys for separate programs, so you can revoke one without stopping the others.
  • Revoke any key you no longer use, from Settings, then API. See Authentication for how a program uses a key.
If you run an unattended strategy, use a heartbeat so your unmatched orders are cancelled if your process stops. Matched positions stay open.

​
Phishing

MagicMarkets will never ask for your password, your two-step codes or an API key. Nobody from support needs any of them. Check the domain before you sign in. The site is magicmarkets.com, and these docs are at magicmarkets.com/docs. Contact support only at support@magicmarkets.com. Do not use a support link somebody sent you.

​
Identity verification

Requested once lifetime deposits reach 10,000 USDT, through a specialist third-party provider. Any amount above that is held until you verify or withdraw it. See Identity verification.

​
Fair settlement

Settlement runs on published per-sport rules, applied uniformly to every account. No position is settled differently because of who holds it. See Settlement.

​
If you think your account is compromised

  1. Secure the email account or Google account you sign in with: change its password and sign out its other sessions.
  2. Revoke every API key.
  3. Turn on two-step verification if it is not on already.
  4. Check Transaction history for withdrawals you did not make.
  5. Contact support with what you found and when.

​
Reporting a vulnerability

If you find a security issue, tell us before you tell anyone else. Email support@magicmarkets.com, start the subject with “Security”, and include enough detail to reproduce the issue. There is no bug bounty programme at present.