Accounts & Sign-in

Hub › Other Systems › Accounts & Sign-in

Your account is the login you sign in with. The server mints it the first time that login arrives, holds every save it ever accepts, and is the only side that decides what the account owns. The game never stores a password of yours and never sees one: every sign-in goes through the provider's own page.

Signing in

One door per provider. The sign-in gate shows a button for every provider the server has configured: Steam always, and Google, Discord and Apple when their keys are set (0.93: Steam, Google and Discord are configured; Apple appears the day its key does). The list comes from the server (/api/auth/providers), so the gate never offers a door that does not open.
The Steam client signs you in by itself. Inside the Steam download the shell hands the server a Steam session ticket; there is no page to visit. The web build at playdfmc.com uses Steam's own sign-in page.
Your identity is the provider's id (Steam ID, Google subject, Discord id). That id is the account; the name you pick for your character is a separate thing (below).
Sign Out (Settings › Account & Data) saves the climb, ends the session and returns to the gate.

One climb, several logins

Link Account (Settings › Account & Data) shows every configured provider; a gold one is linked. Linking lets a second login open this same climb: sign in later with Google or Discord and you land on the same save, the same creatures, the same Wraithgold. A link is made from inside a signed-in session, so nobody can attach a login to your account without being in it.

If the login you link already has a climb of its own, the two accounts are merged, and a merge is not a reset: the server keeps one of the two climbs and records what the other one held. Decide which login is the main one before you link.

One window owns the save

Only one window may write your save at a time. Opening the game in a second tab, window or device hands ownership to the newer one and the older one stops with “This window no longer owns your save”. Nothing is lost: the save the server holds is the last one it accepted. Close the extra window and reload the one you want to keep playing in (Networking has the mechanism, the ownership epoch).

Your character's name

Chosen at character creation and claimed on the server: the name is trimmed, runs of spaces collapse to one, it is checked against the name filter, and a name another player holds is refused before the climb starts.
Inside the Steam client the field is pre-filled from your Steam persona, folded to the allowed character set; you can change it.
There is no rename in game. A name that needs changing is a report; it is done by hand.

Reset, export, delete

Control	What it does
Export My Data	Downloads your save as a JSON file. Everything else the server holds about you is listed in the Privacy Policy.
Reset Progress (New Game)	Resets everything (T61, D 2026-11-02: “per account reset should RESET everything”): creatures, gear, floor, badges, boards, ratings, bought bag slots, boons, pending trades — the climb starts again at Floor 1, Lv 1 with a new character. Two things stay: the login itself, and any Wraithgold you paid real money for (paid money is never deleted by a reset — T3). Free or earned Wraithgold goes with the rest.
Delete Account	Two steps — what goes, then the typed word DELETE. The account is marked for deletion 7 days out and every device is signed out; signing in before the day offers to cancel. After it, the account and every linked login are gone. delete-account.html is the same flow from a browser.

Where the documents live

Settings › Legal & Support opens this site — codex.playdfmc.com — for Help & FAQ, the Privacy Policy, the Terms of Service and the Credits (the old GitHub Pages address forwards here).

Implementation notes

Doors: GET /api/auth/providers (the gate's list), /api/auth/steam + /callback (web), /api/auth/steam/ticket (the Steam shell), /api/account/identities, /api/account/link, /api/account/merge, /api/account/reset, /api/account/delete and /delete/cancel, /api/logout, /api/me, /api/name/claim.
The client reads the provider list once at boot (window.__HT_AUTHP); the Link Account row's segments are that list.
Reset scope: src/worker.js T61 block — every realm-scoped table goes, the wallet_ledger keeps rows with prov LIKE 'paid_%', the identity rows stay. Probe tools/probe_t61_resetall.py.
Deletion: POST /api/account/delete with {confirm:'DELETE'}; the save is flushed first so a cancel inside the 7 days restores it whole.

Changelog

2026-11-03 — page written (D 2026-11-03: “add whatever sections and systems we have in the game but not on the codex”; dfmc-client lane codexreview-b). WIKI ONLY, no game behaviour. Sign-in by every configured provider (Steam, Google, Discord; Apple when keyed; lane googlebtn, board N1), Link Account, the one-window rule, the name claim, Export / Reset (T61 full scope, T3 paid Wraithgold stays) / Delete (7 days), and the codex host move (lane codexhost, board N5). Nothing here was on any page before; help.html and settings.html link here.