Your Sign-in Security Over the API, MCP and the CLI
Read whether two-step verification is on for your BankSync login, whether a recovery key was saved or used, and your recent security activity, from a script, an AI agent or the CLI.
2 min read
On this page
Your BankSync login's sign-in security is readable from outside the app: whether two-step verification is on, whether you saved a recovery key or used one, and your recent security activity. A script can check whether two-step verification is on, an AI agent can answer "is my account protected?", and the CLI prints it.
Everything here is read-only. Turning two-step verification on or off, replacing your authenticator and using a recovery key happen only in the app, in your own signed-in session.
Whose account#
Always yours: the person the credential acts for. An API key reads its owner's account; an app you connected reads the account of the person who connected it. There is no input that names another person, so nobody can read another member's security, whatever their role. Apps installed from the marketplace are refused.
The credential needs the View your sign-in security permission (account:read). New CLI logins ask for it; an existing API key needs it added.
What you get#
| Field | Meaning |
|---|---|
twoFactor.enabled | Two-step verification is on |
twoFactor.enrolledAt | When the current authenticator was added |
recoveryKey.saved | You confirmed saving a recovery key for this authenticator |
recoveryKey.usedAt | The last sign-in with this authenticator's recovery key |
needsReplacement | The recovery key was used: replace your authenticator in the app |
verifiedAt | When BankSync last verified the authenticator with the sign-in provider |
Activity entries have a kind (factor_added, factor_removed, recovery_key_saved, recovery_key_used, support_mfa_reset), an actor (self, or support for a reset by BankSync support) and a time. Nothing else: never a secret, a key, a code, a device or an address.
The status is "as last verified": BankSync checks the authenticator with the sign-in provider whenever you change it or open Settings, Security, so a change made a moment ago on another device appears after your next visit there.
REST#
curl -H "X-API-Key: $BANKSYNC_API_KEY" https://api.banksync.io/v1/account/securitycurl -H "X-API-Key: $BANKSYNC_API_KEY" "https://api.banksync.io/v1/account/security/activity?limit=20"Activity is newest first, at most 50 per page; pass nextCursor back as cursor for older entries.
MCP#
Two tools: get_account_security and list_account_security_activity. Ask your agent "Is two-step verification on for my BankSync account?" or "What changed in my BankSync security this month?".
CLI#
banksync security statusbanksync security activity --limit 50 -o jsonRelated: Two-step verification.
Use this page with your AI assistant
Every BankSync doc is available as plain Markdown for agents and LLMs.