The web terminal

The web terminal at koine.markets/terminal trades from a browser, signed in with a Solana wallet or with Telegram. If you link both, they reach one account, one wallet and one set of knots.

Pages #

Source: app/web/src/terminal/main.tsx, app/web/src/terminal/components/terminal/PlainPages.tsx, app/server/terminal.ts

How the browser talks to Koine #

The page calls /terminal/api/... on the site. The site's server signs each request on to the trading service with a secret shared only by those two (SITE_TRADE_SECRET), over the method, path, session and body, and each signature is accepted once within 60 seconds. Your session token sits in an httpOnly cookie, so page scripts never hold it.

The cookie covers the whole site (koine_sid, Path=/), so the launchpad's pages use the same session: their header, trade drawer and presale actions call the same /terminal/api/..., and the coin community endpoints read who you are from it. A session from before this (the koine_session cookie, Path=/terminal) still works and moves to the new cookie on its next call. Preview hosts (PREVIEW_HOSTS) refuse sign-in and every write.

Source: app/server/terminal.ts (forward, accountOf), app/server/http.ts, app/server/terminal.test.ts, trade/server/server.ts, trade/server/internal.ts

Signing in #

There's no password.

With Privy. Press Sign in (here or in the launchpad's header) and use your email (a one-time code), a passkey, or a Solana wallet, which only proves who you are. See Accounts and sign-in.

With Telegram.

1. Press Sign in with Telegram. It opens the bot with a one-time link valid for 5 minutes.
2. The bot names the browser that asked and the time, and says what confirming allows.
3. Only confirm if you just pressed sign in yourself. If someone sent you the link or told you a number, tap ✖️ No, this wasn't me.
4. Your browser shows a two-digit number. Tap the same number among three in the bot. A wrong number cancels the sign-in.
5. The browser opens your account, and the bot sends an alert about the new sign-in with a 🚪 Sign that browser out button.

Either way a session lasts 30 days. Koine stores session tokens, and the secret your browser keeps during a Telegram sign-in, only as hashes. You can see and sign out browsers on your profile's Browsers tab, or in the bot under ⚙️ Settings → 🖥 Web sign-ins.

Starting Telegram sign-ins is capped at 120 a minute across everyone. Privy sign-ins are capped at 30 a minute per visitor, and new accounts at 10 an hour per visitor.

Source: trade/server/sessions.ts, trade/server/web.ts (/web/login/*, /web/privy/login, tooMany, loginFlood), trade/server/privyauth.ts, trade/server/bot.ts (loginPrompt), app/server/terminal.ts

What the web can do #

• Buy and sell. Pick an amount and press Review. That runs Koine's checks and your knots and gets a signed quote. Hold to confirm sends it: keep the button pressed for half a second, or hold Enter or Space. A tap does nothing and moving off cancels. With a screen reader, activate it twice. A quote on screen is replaced every 20 seconds, and one older than that can't be sent from the page. Sell presets are 25%, 50%, 75% and 100%, or any percentage.
• Instant. Off by default. Turn it on in Settings and the first press sends, with no review and no hold. Knots still hold buys.
• Exits on one position, limit buys and price alerts. See Exits, Limit orders.
• Knots and styles. Tie, change and untie every knot under the same rule as the bot.
• The kill switch. Stop buying asks first, then ties ⛔ Stop all buying.
• Sell everything. Asks first, then sells every open position, hidden ones too.
• Hide positions. Any position can be hidden on the web. It stays open.
• Settings. Slippage (5, 10, 15, 25, 50%), speed and one to four buy buttons of up to 1,000 SOL each. These are the same settings the bot uses.
• Withdraw to your saved address after a confirm that states the amount and address, and cancel one that's waiting.
• Referrals. See your link and stats and pick a name. See referrals.
• Browsers. List signed-in browsers and sign any out, or all.
• Presales. Deposit, withdraw, claim, refund, follow and buy at open. See Presales.

Holds read the same as in the bot and name the knot. The terminal can also be installed as an app from your browser.

Source: app/web/src/terminal/components/terminal/SwapCard.tsx, useTrade.ts, TradeReview.tsx, TerminalHome.tsx, PositionsPanel.tsx, app/web/src/terminal/components/ui/HoldButton.tsx, app/web/src/terminal/components/terminal/app/InstallHint.tsx, trade/server/web.ts

What needs more than a session #

A browser session alone never changes the withdrawal address or exports the key.

Signing in again means Privy's sign-in once more (a new email code, your passkey, or your wallet), checked by the server as a new login. See Accounts and sign-in.

So a stolen session can trade, change knots under their usual rules and withdraw to your own saved address, but can't send SOL anywhere else. Trading can still lose your balance, for example in a swap into a token whose pool the thief controls.

Signing in again doesn't skip anything else: an address change (after the first address) and an export still wait your untie delay, and each of these actions needs the approver.

Save a withdrawal address before you need it. The web can't withdraw until you do.

Source: trade/server/web.ts (handleWebOnly), trade/server/sessions.ts, trade/server/reconfirm.ts

Alerts #

With Telegram, messages come through the bot: fills from exits, deposits, withdrawal receipts and new sign-ins. An account with no Telegram gets them only in its inbox, under Alerts on the terminal home and on /profile/alerts (the last 50). Nothing is pushed to you, so an exit that fires won't reach you until you come back. Inbox messages show only Solscan links.

Source: trade/server/deposits.ts (notify), trade/server/web.ts (inbox, messageView), app/web/src/terminal/components/terminal/TerminalHome.tsx, TraderProfile.tsx (AlertsPage)