houseWhy you sign in with a wallet, not a password
Passwords are the weakest part of most online accounts. People reuse them, sites leak them, and phishing pages collect them. In our games there are no passwords at all. You sign in with the Solana wallet you already use.
How Sign In With Solana works
- We issue a challenge. When you click sign in, our server creates a random single-use nonce, tied to your connection and valid for five minutes.
- Your wallet signs a message. The message names our domain, includes the nonce and the time it was issued and expires, and states plainly that it does not send a transaction or cost a fee.
- We check everything. The server confirms the nonce is one it issued and hasn't been used, checks every field of the message against what it issued, and verifies the Ed25519 signature against your wallet address.
- The nonce is burned. Each challenge works exactly once, so a captured signature can't be replayed.
Signing a message is free and never moves funds. Your wallet's private key never leaves your wallet; we only ever see a signature and your public address.
Sessions we can't leak
After you sign in, your browser holds a session token: 32 random bytes. Our database doesn't store the token itself. It stores a keyed hash of it, so even a full copy of the database couldn't be turned back into working sessions.
The same session also authenticates your real-time connection, which carries live multiplayer updates and chat, so there is one sign-in for everything.
Extra protection when you want it
Players who want a second factor can turn on authenticator-app codes. The secret behind those codes is encrypted at rest, and recovery codes are stored only as keyed hashes.