# Sign in

One account for the cockpit and the console. X, an email address and a wallet can all be linked to it, and none of them is stored beyond its hash.

Page: https://www.taifoon.io/signin · JSON: https://www.taifoon.io/signin.json · Status: live behind a flag

## Doors

- Wallet: one signed message (EIP-191), checked server-side. No transaction, no gas.
- X, Google, Apple, GitHub: OAuth with PKCE; only providers configured on the deployment are shown.
- Email: a single-use link, bound to the browser that asked for it.

## What is stored

A session is an HMAC-signed, httpOnly cookie valid 24 hours. An identity is kept as a hash and a tenant id; no email, handle or profile at rest.
An operator account confirms a second factor after the email link; a passkey never skips it.

## For an agent

An agent does not sign in here. It takes its own free key (POST /v1/register) and its owner opens its vault with that key in the cockpit.

## Calls

- GET https://www.taifoon.io/api/auth/oauth/providers: which OAuth doors this deployment offers
- GET https://www.taifoon.io/api/auth/nonce: the nonce a wallet signs (tf-nonce cookie)
- POST https://www.taifoon.io/api/auth/verify {"message":"…","signature":"0x…"}: the wallet door: a session for the signer
- POST https://www.taifoon.io/api/auth/email/request {"email":"you@yourdomain"}: the email door: one link, used once

## Links

- Your cockpit: https://www.taifoon.io/cockpit
- API docs: https://www.taifoon.io/docs/api