Creating an account

There are two ways to get a Cordavix account: via Discord, or via email address and password. Both lead to the same account system – you can additionally link the other route at any time later on.

Registering with an email address and password

On the registration page you provide a username, your email address and a password. The password has to be at least 10 characters long; very commonly used passwords are rejected so that your account is not easy to guess. We never store passwords in plain text, only ever as a scrypt hash.

You also have to actively confirm the terms and conditions and the privacy policy – neither checkbox is pre-selected. Signing up for the newsletter is optional and completely independent of registration.

Once you submit the form, a session is created immediately and you land in the dashboard. At the same time you receive an email to confirm your address – some features (for example certain prize draws) require a confirmed email address.

Signing in with Discord

If you click "Sign in with Discord" instead, we redirect you to Discord (OAuth2 with a security token to prevent forgery). After you confirm at Discord, a Cordavix account is created automatically or linked to your existing account, and you land straight in the dashboard – with no password of your own at all.

Afterwards: merging accounts

If you registered with an email address first, you can link your Discord account at any time afterwards in the "Account → Connections" section (see the guide "Connecting Discord"). Conversely, you can add an email address and password to an account created via Discord later on, so that you can also sign in without Discord.

Two-factor authentication

We recommend enabling two-factor authentication (TOTP, compatible with common authenticator apps) in the security section of your account right after registering. In doing so you receive ten backup codes, which you should note down somewhere safe – they are shown to you only once.

Sign-in problems

After several failed sign-in attempts, an account is locked for a limited period in order to make automated attacks harder. You can reset a forgotten password via "Forgot password" using a time-limited, single-use reset link; for security reasons, resetting automatically ends all existing sessions.