Sign-in security and sessions
The cabinet is protected by the same Telegram as the bot: every sign-in is reported in a message, any session can be ended with one button, and dangerous actions from the site are confirmed in the chat with the bot.
What it is
- There is no password: “We never ask for a password — neither here nor in the bot”. Anyone asking for a Sync password is a scammer.
- Check the address: “The website address is app.sync.trade”, “The connection is secure — a lock icon and https”.
- A session is one sign-in on one device. There can be several: a computer, a phone, the mini app.
The sign-in message
For every sign-in (except the mini app) the notification bot sends:
🔐 Web cabinet sign-in
Method: «Log in with Telegram» button Device: … IP: … Time: … (UTC)
If this was not you, tap «End all sessions».
The method can be: «Log in with Telegram» button, link from the bot, QR code, Google, Yandex ID. Under the message is the 🔐 End all sessions button; the bot replies: “✅ Web cabinet sessions ended: …. To sign in again, open the cabinet anew.” The same button is on the ⋯ More → 🌐 Web version screen (“🌐 Web version and sessions”).
Where on the site
Settings → Sessions — “Where the cabinet is open right now. Don't recognise a device? End that session.” Each session shows: the device, the sign-in method, IP, the activity and sign-in times, the “remembered for 30 days” mark and “This browser” for the current one.
- End — close one session; End all except this one — “The cabinet will be closed on all other devices — you will need to sign in there again. This session stays open.”
- Settings → Sign out on all devices — “End all cabinet sessions, including this one?”
- The page tip: “You can also end all sessions from the bot: the «🔐 End all sessions» button in the sign-in message and on the «⋯ More → 🌐 Web version» screen.”
Confirmations in Telegram
| Action on the site | Message in the bot | Buttons |
|---|---|---|
| Add an exchange account | “🔐 Connecting an exchange account” — market, name, the start of the key, device and IP | ✅ Confirm (15 minutes) / 🚫 This was not me |
| Change keys | “🔐 Changing API keys” | ✅ Confirm (15 minutes) / 🚫 This was not me |
| QR sign-in | “📱 Web cabinet sign-in with a QR code” | ✅ Confirm sign-in / 🚫 This was not me |
| Connect Google or Yandex ID | “🔗 … sign-in connected” | 🚫 Not me — disconnect … |
| Delete an exchange account | “🗑 The exchange account «…» was deleted in the web cabinet.” | 🔐 End all sessions |
After 🚫 This was not me the bot replies: “🚫 The request is cancelled, web cabinet sessions closed: …. If you did not sign in to the cabinet, turn on two-step verification in Telegram (Settings → Privacy).” The request is cancelled and all sessions are closed.
If the sign-in was not yours
- Tap 🔐 End all sessions in the sign-in message or on the ⋯ More → 🌐 Web version screen.
- Turn on two-step verification in Telegram: Settings → Privacy.
- Check Settings → Sign in with Google and Yandex ID — disconnect the methods you did not connect.
- Write to support.
Only in the bot
All the ✅ Confirm / 🚫 This was not me confirmations and the sign-in messages come only in Telegram — they are not on the site, so a stolen cabinet sign-in cannot connect someone else's keys or change payout details.