# Signing in

Three ways in: GitHub, Discord, or a demo account an owner hands you. All three land in the same console. There is no email and password signup, because passwords you choose are the weakest part of most accounts and we would rather not hold them.

## GitHub and Discord

One click each, standard OAuth. First visit creates the account; every visit after signs into it. A Discord account and a GitHub account are different accounts even with the same email, because the provider id is the identity, not the address.

Signed in already and opening [/login](/login)? You bounce straight to the console (or to the ban screen, if that is your standing). A login page that greets someone already inside is a door that opens onto itself.

## Demo accounts

Owners create demo accounts from the Panel: a lowercase username, a password of eight characters at least, and optional starting credits. The password is salted and stretched with scrypt and cannot be recovered or read back, same promise as every other password hash we hold.

Demos sign in at [/login/demo](/login/demo), a page with nothing on it but the form. Wrong either way gives one deliberately vague answer, so neither half of a guess can be confirmed separately, and guessing is strictly rate limited.

A demo that runs its course is ended, not banned: the account sees a demo-ended screen that names no violation, because none happened. See [Bans and appeals](/docs/bans).

> Sessions last thirty days and live in httpOnly cookies. Logging out deletes the session everywhere that session was valid, not just in the browser you clicked in.