Accounts and sign-in
Registration is invite-only. How to sign in, reset a password, and what an admin can do that you cannot.
Registration is invite-only
There is no open sign-up. An account is created with an invite code issued by an admin, and a code is a bearer ticket: whoever holds it can register, once. Treat an unused code the way you would treat a password, because that is what it is until it is spent.
Sign-up asks for three things:
| Field | What it is for |
|---|---|
| Identifies the account and receives password resets. It is not verified and no mail is sent on sign-up. | |
| Password | The account password. At least eight characters. |
| Invite code | The single-use ticket an admin gave you. A used or unknown code is refused with the same message either way. |
Once registered, the code is gone. If you need a second account you need a second code.
Signing in
Sign in with the email and password. The session is a token held in your browser; it expires after a while and you sign in again. Nothing in the console depends on staying logged in: a launch, a bundle or a volume bot that is running keeps running on the server whether your browser is open or not, and the job's log is there when you come back.
Repeated failed attempts from one address are throttled. If you are locked out for a minute, that is the throttle, not a disabled account.
Forgotten passwords
The login screen offers Forgot password only when the deployment has outgoing mail configured. If the link is missing, mail is not set up and an admin has to help.
When it is available: enter your email, and a reset link arrives that works once and expires in minutes. The token travels in the URL fragment, so it is never written to a server log. The message after you ask is the same whether or not the email exists, so an address cannot be probed that way.
Your account password is not the same thing as your wallet password, which encrypts private keys in the wallet book. Losing the account password is recoverable by email; losing the wallet password is not.
Roles
Accounts are either user or admin.
An admin can, from Settings:
- issue invite codes and see which ones are still unused;
- list every account, and disable or re-enable one;
- check the mail configuration end to end by sending a test message;
- see the fee configuration the deployment runs with.
An admin is also exempt from the platform fee. A run from an admin account prints
fee: nothing charged, admin accounts are exempt in its log. If you are testing the fee path, do
it from a user account, not the admin one.
Everything else is scoped to the account that created it. Another account cannot see your wallets, your positions, your volume bots or your CEX orders, and cannot delete them even with its own valid wallet password. The admin account has no view into other accounts' wallets either.
Signing out
The Sign out button at the bottom of the sidebar drops the session in this browser. It does not stop anything running on the server.