Accounts & authentication

What visitors need to know

Browsing repositories, reading documentation and downloading prepared briefs do not require an account. Saving a vote, submitting a request and starting a request’s build require connected storage and an authenticated account.

Connecting a wallet only exposes its address after wallet consent. It does not establish request ownership, unlock votes or grant operator permissions. The application does not request a seed phrase or private key.

Gateway responsibilities

• Authenticate the session with an identity provider controlled by the operator, including expiry and logout handling.
• Strip incoming x-forkd-gateway-secret, x-forkd-user-id and legacy identity headers before forwarding.
• Derive a stable lowercase 64-character hexadecimal HMAC-SHA-256 identifier from an app-scoped provider subject with a separate private HMAC key.
• Send the opaque identifier and shared gateway secret only over HTTPS, and redact both from infrastructure logs.
• Omit authenticated identity for anonymous visitors; never assign all visitors one shared account.

Application-side verification

FORKD_AUTH_GATEWAY_SECRET must be 32–512 characters and remain private. The application validates the supplied identifier format and compares fixed-size secret digests. Missing, weak or incorrect configuration returns an anonymous identity.

Do not derive public identifiers from an unkeyed email hash, forward raw profile fields or expose the secret through NEXT_PUBLIC_ variables. Restrict direct origin access to the gateway where the hosting platform supports it.

Sign-in is an integration point

The existing UI sign-in route is /signin-with-chatgpt?return_to=.... The operator’s gateway must handle that route, authenticate the session and return to a validated local path. Its name does not create an OAuth integration or provide a sign-in service by itself.

Reject external and protocol-relative return URLs. No provider session implementation is bundled with the public application. A 404 on that route indicates a missing gateway integration rather than a wallet problem.

Separate user and service authority

Ordinary users can vote and create requests; only the requesting account can run its review and build actions. Runner event and completion callbacks require BUILD_RUNNER_SECRET. Recording settled credit requires OPERATOR_API_SECRET.

Each credential should be scoped to its service and configured privately. Changing an account ID must not grant access to another account’s request controls.