Accounts & security

Everything a player does starts with an account. This page covers signing up, signing in, the session model, two-factor authentication, and the settings screen where people manage all of it.

Signing up

Registration is email and password. The form can also collect a name, date of birth, phone number, a referral or affiliate tag, and marketing attribution (UTM parameters and Facebook click IDs) when those are present in the link the player arrived from.

A signup does more than create a row. In one pass the platform:

• stores the user and any marketing attribution,
• fires the registration bonus trigger, so a welcome offer can land immediately,
• runs a first segment evaluation against the new profile,
• and sends a CompleteRegistration event to Facebook's conversions API.

That chain is why a brand-new player can already belong to a segment or hold a pending bonus the moment they finish registering.

Signing in

Login runs through NextAuth's credentials provider with a JWT session. The session is the interesting part: it carries a unified API token that the browser attaches to every call it makes to the Hono API. Because the token travels with the request, the same identity works across the web app and the API even though they sit on different origins.

When the session JWT is decoded server-side, the platform writes a session record to the database with the device, browser, IP, and last-active time. Two things invalidate a session right away: the account being blocked, and the token version moving on (which is how a global sign-out works).

Login, password reset, and the 2FA endpoints are rate limited to five requests per minute per IP.

Sessions

A player can see every active session for their account and where it is signed in. From the settings screen they can revoke a single session or sign out everywhere at once. The current session is flagged so it is obvious which one they are looking at.

Two-factor authentication

2FA is TOTP-based, the kind you pair with an authenticator app. Setup generates a QR code and a manual entry key and stores a pending secret, but 2FA stays off until the player confirms it with a valid code. Disabling it also requires a current code, so a walk-up attacker cannot simply turn it off.

There is a verification endpoint intended for the login step, though today the enable/disable flow lives in settings rather than as a hard gate during sign-in.

Settings

The settings screen is the player's self-service hub, organized into tabs:

• Account — email, name, join date, and email-verified status.
• Protection — change password (current plus a new one, minimum eight characters), manage 2FA, and review or revoke sessions.
• Wallet — quick access to deposit and withdraw, plus saved wallet addresses.
• Transactions — a unified history that merges deposits, withdrawals, bets, game sessions, bonuses, tips, and payments, with paging and filters.
• Notifications — the in-app inbox.

KYC also surfaces here: players submit and track verification status from settings, and an unverified or pending state shows as a banner on the home page.