Sign-in and accounts: the plan
Planned. Nothing here is live: there is no sign-up or sign-in yet. Updated 2026-11-08.
Principles
- Invite only to begin with: you need an invite to register.
- Anonymous by design: players are an alias. We keep as little personal data as possible: a sign-in provider and an anonymous ID, plus an email address only for the email-link option.
- Tracking means only this: telling the creator when someone is the first to do something, or reaches a milestone, shown by alias on a scoreboard. Players agree to that when they register. No browsing history, no device fingerprints.
- A backup of the scoreboard and accounts, so nothing is lost.
- The choice of account is yours: for Google the sign-in asks which account to use.
The first five options, in order, and why
Widest reach (the creator uses it everywhere), a standard sign-in that is well documented, and it can show the account chooser (the prompt=select_account setting). Caveat: developers report browsers sometimes skip the chooser when one account is already signed in, so it needs testing. Needs a Google Cloud OAuth app created by the creator.
Works for everyone without another account and needs no password. Caveat: it needs an email-sending service and good delivery (SPF, DKIM and DMARC records exist for the creator's domains), and it means holding an email address, which is personal data.
Where many gamers and communities already are. Official OAuth2 sign-in; asking only for the basic profile (identify) avoids needing the email. Needs a Discord developer app created by the creator. A good base for a future community server.
The creator's stream audience and the home of the shards currency. Official OpenID Connect sign-in. Caveat: developers have reported documentation inconsistencies, so it must be tested against the live service.
No password to steal, resistant to phishing, and the creator already uses them on another site, so a design exists to reuse. More work to build than a standard sign-in button.
Later: Apple, Microsoft, GitHub.
How the order was chosen: widest use first, then easiest to install, then fewest known problems. That is a judgement from official documentation and developer forum reports, not a formal bug count. Sources: Discord OAuth2 docs, Twitch OIDC docs.
Tips and tricks
- Google: ask for the account chooser every time so people who use several Google accounts pick the right one.
- Ask each provider for the least data you can (name or alias, not email) and say plainly what is kept.
- Test each provider on a real phone and in a private window before announcing it.
- Keep one recovery path (for example the email link) so nobody is locked out when a provider has a problem.
Safety
Before any chat, profiles or social pages open to strangers, a written safety plan is needed: reporting, blocking, moderation and an assessment under the UK Online Safety Act, which Ofcom says applies to small services too (it scales with size and risk). Invite-only plus preset phrases keeps that risk low. This has not been legally reviewed.
Ofcom guidance: https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/quick-guide-to-online-safety-risk-assessments/