docs

accounts & security

login methods, embedded wallets, mfa, and how wen protects an account.

signing in

wen accounts can be created and accessed with:

• Email and password.
• Passwordless email verification (a one-time code, no password to remember).
• Google.
• Apple.
• Telegram.
• Any combination of the above linked to the same account - you're never locked into the method you started with.

Standard account flows are all in place: email verification and resend, forgot-password and password reset, an authenticated password-change screen, session refresh, logout with session revocation, and 2FA setup, enablement, and disablement.

your wallets

wen automatically creates embedded, self-custodial wallets during onboarding:

• One Solana wallet.
• One EVM wallet, usable across every supported EVM network from a single address.
• A dedicated perps account and trading-agent setup, created when you enable perps.

You never manually choose a chain, bridge, or route for normal activity - wen handles it behind a single interface. See Wallet & portfolio for the networks this covers.

You retain full control of these wallets. Private-key export is protected by identity verification and 2FA through a dedicated, gated flow. Full detail on what wen can and cannot see is in the safu page.

how wen protects an account

• Short-lived authenticated sessions with secure refresh-token rotation.
• Detection and automatic revocation of reused refresh tokens - a sign a session was copied or replayed.
• MFA through an authenticator app or passkey, which gates sensitive actions like private-key export.
• Validation on every trade, reward, referral, and competition entry.
• Rate limits and replay protection on sensitive actions.
• Retry protection on deposits, orders, rewards, and payouts, so a flaky connection or double-tap cannot apply the same action twice.

None of this requires you to do anything differently. It's the reason a deposit that times out doesn't quietly double, and the reason wen never asks you for your password, 2FA code, or exported key over chat or email.