Sign In With Your Social Identity, Not Another Password

How auth works now

We shipped social auth. You sign in to Remix through Farcaster or Telegram, and the system never provisions or stores a password. Both providers act as the identity channel: the client completes the provider handshake, the server verifies the signed proof, and we mint a Remix session keyed to the resolved identity. There is no password table, no reset flow, and no credential to phish.

The reason this is the right abstraction goes deeper than convenience. Password auth forces every new player to create an identity from zero, which gives us a row with no history and the user a string to forget. Provider auth instead resolves an identity that already exists in a social graph, so the session attaches to a real account on day one.

Identity sync from the social graph

On first sign-in we pull provider-specific fields off the connected account and persist them: the Farcaster handle, the Telegram handle, and a profile image. Those map onto provider columns (for example farcasterUsername, telegramUsername) rather than overwriting a player's app-facing Remix username and avatar once they own a Remix record. So you can link a provider for auth without it clobbering the name you chose here. Identity stays portable across the platform: plays, leaderboard standing, and the creator rewards we will build later all hang off one stable user record instead of a throwaway login.

Session handling and abuse gating

Sessions are issued server-side and scoped to the verified provider identity, not to anything the client can spoof. We do not trust query-string tokens or Referer values for auth; the only thing that establishes a session is a verified provider proof exchanged through the real auth channel. That closes the obvious impersonation path where an attacker forges a token and rides someone else's account, and it gives us a single chokepoint to rate-limit and gate suspected abuse before a session is ever minted.

The point of removing passwords is not just speed. When an AI game maker collapses the time from idea to published game to an afternoon, sign-up cannot be the slow, lossy step that throws away who you already are. This is the first layer everything else stacks on.