Accounts and signing in

Every lord belongs to an account: an email address and a password. You make one when you first join, pick your lord's name, portrait and coat of arms, and then choose a starting village on the world map. After that you sign in with the email and password from any browser.

The basics

1. Register with an email and a password of at least 8 characters.
2. Name your lord. The name is unique across the realm and cannot be changed later.
3. Pick a portrait and design your arms. Both can be changed later from the Lord panel.
4. Choose a starting village on the world map (see Getting started).
5. Next time, sign in with the same email and password. "Sign out" is in the Lord panel.

Registering

Registration has three steps, shown at the top of each form: Account, Lord, Village.

Field	Rule
Email	Must look like an address (something@domain.tld), at most 254 characters. Case does not matter. One lord per email. Other lords never see it.
Password	8 to 128 characters. It cannot be the email, the part of the email before the @, the lord's name, or one character repeated.
Name	3 to 24 letters, digits, spaces, apostrophes, hyphens or underscores. Runs of spaces become one. No other lord may hold the same name, ignoring case; that includes lords from before accounts existed.
Portrait	One of the 12 painted portraits.
Arms	Shield, division, field tinctures, charge and charge colour, with the same rules as the Profile editor. The form starts with random arms, and "Surprise me" rolls new ones.

The server checks every field. If the email is already taken, the form goes back to the Account step and says so. A brand-new lord holds no village; the world map opens in claiming mode straight away.

The password strength bar under the password field is advice only. The server enforces just the rules in the table.

Signing in and sessions

Signing in gives the browser a session that lasts 30 days. Using it in the second half of that time (after day 15) pushes it out to 30 days from then, so a lord who plays at least every couple of weeks stays signed in. "Sign out" in the Lord panel ends that browser's session and closes its open connections. Sessions on other browsers are not affected.

A wrong email and a wrong password get the same message, "That email and password do not match," so the form does not reveal which emails have lords.

Limits on attempts

Limit	Allowance	Window
Per network address	20 register, sign-in or claim attempts	10 minutes
Per email	8 failed sign-ins (a success clears the count)	15 minutes

Past either limit the form says how many minutes to wait. The counters live in the server's memory, so a server restart clears them.

Lords from before accounts

Before accounts, lords signed in by typing a name, and the browser kept a token for that lord. A browser that still holds such a token opens on a "Secure your lordship" form instead of the game. Setting an email and password there attaches the account to the existing lord, with all villages, Renown and goods unchanged, and the old token stops working. Until then the old token opens only that form, not the game.

Signing in by name alone is gone. A lord from before accounts whose browser no longer has the token cannot be recovered from the sign-in screen.

There is no password reset or email change yet, because the server does not send email. A forgotten password currently needs an admin with database access.

For maintainers

• Server: server/src/auth/index.ts (the Auth class: register, login, claim, sessions, validation, limits), server/src/auth/passwords.ts (scrypt hashing), server/src/auth/limits.ts (rate limiter), server/src/db.ts (accounts and sessions tables), HTTP routes in server/src/index.ts. Tests in server/src/auth/auth.test.ts.
• Passwords are hashed with scrypt (N = 2^15, r = 8, p = 1, 16-byte salt) and stored as scrypt$N$r$p$salt$hash, so the cost can be raised without breaking older hashes. Unknown emails are checked against a dummy hash so they take as long as a wrong password.
• Session tokens are 32 random bytes; only their SHA-256 is stored. SESSION_DAYS is 30. Tokens travel as Authorization: Bearer on HTTP and in the WebSocket hello, not as cookies.
• Behind a proxy, set TRUST_PROXY=1 (Railway is detected from RAILWAY_ENVIRONMENT) so the per-address limit uses the last X-Forwarded-For entry. Without it every player behind the proxy shares one address and one allowance.
• Game.login(name) still makes or finds a lord by name for tests and tools. No HTTP route reaches it.
• Client: clients/web/src/auth/ (forms), clients/web/src/main.ts (signIn, token storage, vk:sign-out), clients/web/src/net.ts (REST calls).