---
title: "Your Sign-in Security Over the API, MCP and the CLI"
description: "Read whether two-step verification is on for your BankSync login, whether a recovery key was saved or used, and your recent security activity, from a script, an AI agent or the CLI."
section: "API"
canonical: "https://banksync.io/docs/api/account-security-api"
specs: ["auth"]
operationBindings: [{"capability":"auth","operation":"auth.security.status.get"},{"capability":"auth","operation":"auth.security.activity.list"}]
---

Your BankSync login's sign-in security is readable from outside the app: whether two-step verification is on, whether you saved a recovery key or used one, and your recent security activity. A script can check whether two-step verification is on, an AI agent can answer "is my account protected?", and the CLI prints it.

Everything here is read-only. Turning two-step verification on or off, replacing your authenticator and using a recovery key happen only in the app, in your own signed-in session.

## Whose account

Always yours: the person the credential acts for. An API key reads its owner's account; an app you connected reads the account of the person who connected it. There is no input that names another person, so nobody can read another member's security, whatever their role. Apps installed from the marketplace are refused.

The credential needs the **View your sign-in security** permission (`account:read`). New CLI logins ask for it; an existing API key needs it added.

## What you get

| Field                  | Meaning                                                                 |
| ---------------------- | ----------------------------------------------------------------------- |
| `twoFactor.enabled`    | Two-step verification is on                                             |
| `twoFactor.enrolledAt` | When the current authenticator was added                                |
| `recoveryKey.saved`    | You confirmed saving a recovery key for this authenticator              |
| `recoveryKey.usedAt`   | The last sign-in with this authenticator's recovery key                 |
| `needsReplacement`     | The recovery key was used: replace your authenticator in the app        |
| `verifiedAt`           | When BankSync last verified the authenticator with the sign-in provider |

Activity entries have a `kind` (`factor_added`, `factor_removed`, `recovery_key_saved`, `recovery_key_used`, `support_mfa_reset`), an `actor` (`self`, or `support` for a reset by BankSync support) and a time. Nothing else: never a secret, a key, a code, a device or an address.

The status is "as last verified": BankSync checks the authenticator with the sign-in provider whenever you change it or open Settings, Security, so a change made a moment ago on another device appears after your next visit there.

## REST

```bash
curl -H "X-API-Key: $BANKSYNC_API_KEY" https://api.banksync.io/v1/account/security
curl -H "X-API-Key: $BANKSYNC_API_KEY" "https://api.banksync.io/v1/account/security/activity?limit=20"
```

Activity is newest first, at most 50 per page; pass `nextCursor` back as `cursor` for older entries.

## MCP

Two tools: `get_account_security` and `list_account_security_activity`. Ask your agent "Is two-step verification on for my BankSync account?" or "What changed in my BankSync security this month?".

## CLI

```bash
banksync security status
banksync security activity --limit 50 -o json
```

Related: [Two-step verification](/docs/account-billing/two-factor-authentication).