Configuration
These pages are under Operator Controls → Exchange → Configuration. For an overview of the menus, see the Operator Controls reference. Tiers are covered in Tiers & Trading Fees.
Onboarding
Sign-up and login settings for your exchange:
- Allow new sign ups: turn sign-ups on or off.
- Email verification: require new users to verify their email. This needs a working email service (see Email). If you turn it off, the page warns you that anyone can sign up with an email address they don't own.
- Sign up domain whitelist: email domains that can sign up and use their account as usual. Sign-ups from other domains still go through but need your manual approval in the Review Queue. Leave the list empty to turn this off.
- Onboarding background image: the background of the sign-up and login pages.
Email
- Email Configuration: the SMTP service your exchange sends email through: sender email, SMTP server, port, username and password. See SMTP Email Setup.
- Customize emails: pick a language and an email type, then edit its title and content.
- Email Copy/Audit: a General audit inbox and a Sensitive audit inbox that receive copies of emails sent to users, for audit purposes.
See also Email Customization & Audit.
Alerts
Get notified when something on your exchange needs attention. Alerts fall into two categories, Operational and Security & compliance, and can be sent by email (to the audit addresses on the Email page), to Slack (with an incoming webhook URL) or to Telegram (with a bot token and chat ID). You can choose individual events and use Send test alert to check delivery. Alerts contain customer details, so send them only to channels your team controls.
Push notifications
Lets the exchange send notifications to users' devices:
- Mobile apps (Firebase): the Firebase keys for your mobile apps.
- Browsers (Web Push): browser push uses a key pair the server generates for you.
Click Save push settings to apply. Treat these keys as secrets: whoever holds them can push to every registered device.
Security
Security settings for the whole exchange. Settings you aren't allowed to change are marked as such. The main settings are:
| Setting | What it does |
|---|---|
| Geofencing | Block activity from the countries you list |
| IP blocklist | Block addresses by hand, or let the exchange block suspicious ones automatically. View blocked and whitelisted addresses from here |
| Attack protection | Automatic blocking presets (Relaxed, Balanced, Strict) and an exchange lockdown |
| Cloudflare Turnstile | Captcha on login and sign-up forms. See Cloudflare Turnstile |
| Cloudflare location | Use the country Cloudflare attaches to each request for login locations. Only turn it on if your exchange is served through Cloudflare |
| Force 2FA on Withdrawal | Require users to have two-factor authentication turned on before they can request a withdrawal |
| Auto Deposit / Auto Withdrawal | Process deposits and withdrawals automatically. With Auto Deposit off, incoming blockchain deposits stay pending until approved by hand |
| Google OAuth | Let users sign up and log in with their Google account, using your Google client ID |
| Login Confirmation | Ask users to confirm a login from a new device or location with a code sent by email |
| Step-by-step login only | Retire the old single-call login so sign-in only works through the step-by-step flow |
| Idle session PIN lock | Let users lock an unattended screen with a PIN |
| Allowed Domains | Which other websites may call your exchange API from a browser (CORS). If you add any domain, add dash.hollaex.com too, or Operator Controls stops working. See Operator Controls |
| Admin IP allowlist | Restrict admin API access to the IP addresses or CIDR ranges you list. An empty list means no restriction |
| Admin API endpoints | Allow API keys with the admin role to call admin endpoints. Off by default |
| API Keys | Create API keys for your own integrations. See API keys |
To invite other operators, use Access Control → Operator Roles.
Features
Turn exchange features on or off. The list includes:
- Announcement: announcement posts and alert pop-ups.
- Pro trade (Markets): chart, order book and limit orders.
- Quick trade (Convert): a simple buy and sell interface.
- Auto Trade: scheduled automatic buys, daily, weekly or monthly. See Auto Trader.
- Cefi Staking: lock coins and distribute rewards. See Staking.
- Profit/Loss Analytics: balance history and profit and loss for users. See Profit & Loss Tracking.
- P2P: P2P trading for merchants and users. See P2P.
- Exchange Analytics: operator reports on volumes, fees and users.
- Notifications: per-user notification inbox, campaigns and push.
- Referral System: user referrals with analytics. See Referrals.
- Chain Trading: let users convert any asset to another. See Smart Chain Trading.
- Fiat Controls: on- and off-ramping for fiat assets. See Fiat Controls.
- Support Tickets: a help desk with routing, shifts, escalation and ratings.
- Chat System: text and emoji chat between users.
Some features are only available on certain plans. When a feature isn't included in your plan, it shows an upgrade prompt instead of a switch. To find out what your plan includes, contact the HollaEx team.
Localization
Regional settings: Country, Timezone, Language, the default Theme, the Native currency (used to value deposits, withdrawals and other amounts) and Other currency display options that users can choose instead.
Apps
Mobile Application Configuration: the current and minimum version of your apps and the Android, iOS and macOS download URLs. Android App Passkeys lets users create and sign in with passkeys inside your Android app.
Announcements, notifications and chat
- Announcements: create announcement posts and pop-ups. The page has Active and Display Locations tabs.
- Notifications (when turned on): send campaigns to users. The page has Campaigns and Compose tabs.
- Chat (when the Chat System feature is on): Messages shows recent chat messages, which you can delete, and lets you ban a user from chat. Banned Users lists banned users; click Unban to let a user chat again.