Step 1 of 2 — your admin password.
Step 2 of 2 — enter the code.
Direct API token (stored only in this browser).
Key must be trade-only: withdrawals OFF, futures ON, IP-restricted to this server. It is verified live before anything is stored.