Two-factor authentication
Google Authenticator–compatible TOTP via Web Crypto (RFC 6238). Backup codes generated at setup. Withdrawals, swaps, and sends can require a valid code.
Trust
Security you can verify
The demo implements real client-side TOTP, session persistence, and role-gated portals. Production deployments should add server-side auth, encryption, and compliance review.
KYC verification
Multi-step identity flow with document upload, selfie capture, and admin review queue. Approved tier updates user session and badges across the app.
P2P escrow
Trades move through in-progress, awaiting release, completed, and disputed states. Vendors release crypto only after payment proof; admins can resolve disputes.
Account controls
Admins can freeze accounts and adjust limits frozen users are blocked from starting new P2P trades in the demo.
Session management
Auth state stored in empire_user with token key for API integration. Logout clears session across portals.
Deploy checklist
Use HTTPS, secure cookies, server-side validation, rate limiting, and never store secrets in front-end code. Replace mock API with audited backend services.