Sign-in and accounts: what is being planned
Planned. Nothing here is live: there is no sign-up or sign-in yet.
Invite only to begin with: you need an invite to register.
Anonymous by design: players are an alias. We keep as little personal data as possible: a sign-in provider and an anonymous ID, plus an email address only for the email-link option.
Tracking means only this: telling the creator when someone is the first to do something, or reaches a milestone, shown by alias on a scoreboard. Players agree to that when they register. No browsing history, no device fingerprints.
A backup of the scoreboard and accounts, so nothing is lost.
The choice of account is yours: for Google the sign-in asks which account to use.
The first five options, and why
- Google: Widest reach (the creator uses it everywhere), a standard sign-in that is well documented, and it can show the account chooser (the prompt=select_account setting). Caveat: developers report browsers sometimes skip the chooser when one account is already signed in, so it needs testing. Needs a Google Cloud OAuth app created by the creator.
- Email sign-in link: Works for everyone without another account and needs no password. Caveat: it needs an email-sending service and good delivery (SPF, DKIM and DMARC records exist for the creator's domains), and it means holding an email address, which is personal data.
- Discord: Where many gamers and communities already are. Official OAuth2 sign-in; asking only for the basic profile (identify) avoids needing the email. Needs a Discord developer app created by the creator. A good base for a future community server.
- Twitch: The creator's stream audience and the home of the shards currency. Official OpenID Connect sign-in. Caveat: developers have reported documentation inconsistencies, so it must be tested against the live service.
- Passkeys: No password to steal, resistant to phishing, and the creator already uses them on another site, so a design exists to reuse. More work to build than a standard sign-in button.
Later: Apple, Microsoft, GitHub.
Tips and tricks learned so far
- Google: ask for the account chooser every time so people who use several Google accounts pick the right one.
- Ask each provider for the least data you can (name or alias, not email) and say plainly what is kept.
- Test each provider on a real phone and in a private window before announcing it.
- Keep one recovery path (for example the email link) so nobody is locked out when a provider has a problem.
Before any chat, profiles or social pages open to strangers, a written safety plan is needed: reporting, blocking, moderation and an assessment under the UK Online Safety Act, which Ofcom says applies to small services too (it scales with size and risk). Invite-only plus preset phrases keeps that risk low. This has not been legally reviewed.