# Accounts and sign-in

You can use Koine with no Telegram and no wallet of your own. One sign-in covers the whole of koine.markets: the terminal, the launchpad's header and trade drawer, launching, steward actions and coin communities. This page covers how you sign in, your Koine wallet, what asks for your sign-in again, and what happens if you lose your way in.

## One wallet

**Your Koine wallet** is a wallet Koine makes for you, under the same [signing rules](https://docs.koine.markets/terminal/security) as every Koine wallet. It's the only wallet the site uses. You fund it by sending SOL to its address, shown on your portfolio and in the launchpad header's menu. Every buy, sell, presale deposit, withdrawal, claim and refund comes from it, with no popup. A coin you launch is paid for from it, and it becomes that coin's steward. On a coin's community page you appear as its short address, and its holdings are what count.

You can export its private key whenever you want (below), and take it elsewhere.

The site never connects your own wallet for money. If you sign in with a wallet, it only proves who you are.

Source: trade/server/users.ts (joinWithPrivy, ensureWallet), trade/server/web.ts, app/web/src/account.tsx, app/web/src/Trade.tsx, app/web/src/Create.tsx, app/server/community.ts

## Signing in

Sign-in runs through [Privy](https://docs.privy.io), with any of:

- **Email:** Privy sends a one-time code.
- **Passkey:** your device's Face ID, fingerprint or security key.
- **Wallet:** a Solana wallet such as Phantom signs a sign-in message. It's never asked to pay or sign anything else.

1. Press **Sign in** in the header of any koine.markets page, or on `koine.markets/terminal`. Pick a way in.
2. The first time, read the notice and press **I understand, create my account**. Your account and its Koine wallet are made then. If the wallet doesn't finish, press **Create my wallet** on your portfolio.

Privy hands the page an access token. Koine's server checks it (Privy's signature for Koine's app, not expired) and swaps it for its own httpOnly session cookie, which covers the whole site for 30 days. Signed in, the launchpad's header shows your Koine wallet's SOL and a menu: the deposit address to copy, Withdraw (your account page), Terminal and Sign out. Signing out ends both Koine's session and Privy's.

Your account is your Privy user. The same email, passkey or wallet always opens the same account. An account made before Privy, with the old wallet sign-in, opens when you sign in through Privy with that same wallet.

When Koine is invite-only (`TRADE_ACCESS=invite`), a new account can't be made: the web has no way to take an invite.

A website account has no Telegram id. Inside Koine it gets a random negative placeholder, so nothing is ever sent to Telegram for it.

**Referrals.** Opening a referral short link, `koine.markets/r/<code>`, stores the code in a `koine_ref` cookie for 30 days and opens `/terminal`. The first link you follow counts: a later one doesn't replace it. When a sign-up makes a new account, the code goes with it and the account is linked to that referrer. The cookie is cleared when a sign-in succeeds.

Source: trade/server/privyauth.ts (verifyAccessToken, privyUser), trade/server/web.ts (/web/privy/login, /web/wallet/create), trade/server/users.ts (joinWithPrivy, attachPrivy), app/server/terminal.ts, app/web/src/terminal/lib/terminal/privy.tsx, PrivyLayer.tsx, app/web/src/terminal/components/terminal/SiteSignIn.tsx, app/web/src/account.tsx (SignInHost, HeaderAccount)

## What asks for your sign-in again

Being signed in isn't enough for these. Each opens Privy's sign-in again: a new email code, your passkey, or a new signature from the wallet you sign in with. A stolen session cookie can't do any of them.

| Action | What it still waits for |
| --- | --- |
| Saving or changing the withdrawal address | Your untie delay (not for the first address), and the approver |
| Starting a key export | Your untie delay, and the approver |
| Revealing the key | The approver |
| Handing over a coin's stewardship | Nothing more: it's immediate |

How the server knows the sign-in is fresh: Privy starts a new session (`sid`) only when someone logs in, and refreshing a token keeps the old one. So the page logs out of Privy and in again, and Koine accepts the new token only if it's for your account, from a Privy session Koine has never seen, and issued in the last two minutes. That gives one confirmation, for that one action with those details (the address, the browser's key, the coin and new steward), usable once within 5 minutes. A Privy session that signed you in, or confirmed something before, can't confirm anything again.

Source: trade/server/reconfirm.ts (reconfirm, spendConfirmation), trade/server/web.ts (handleWebOnly, confirmDetail), app/web/src/terminal/lib/terminal/privy.tsx (reconfirm), app/server/http.ts (handover)

## Exporting your key

1. On your account page, press **Export key** and confirm your sign-in. It waits your untie delay, if you set one, and you can cancel until it unlocks.
2. When it unlocks, you get a message in your inbox. You have 24 hours to reveal the key. After that it lapses and you can ask again.
3. Reveal it on a device only you can see, and confirm your sign-in again. Your browser makes a one-time HPKE key pair and sends only the public key; the confirmation names that key.
4. The key arrives encrypted to your browser and the page decrypts it. It doesn't pass through Koine's servers in readable form.

An export you started in the bot finishes in the bot, and one started on the web finishes on the web.

After an export, Koine's knots, delays and signing rules can't protect that wallet from whoever holds the key.

Source: trade/server/export.ts (requestExport, revealForWeb), trade/server/web.ts, app/web/src/terminal/lib/keyExport.ts, app/web/src/terminal/components/terminal/AccountWeb.tsx

## Alerts

Without Telegram, alerts appear only in your inbox, under Alerts on the terminal home and on `/profile/alerts`: fills, deposits, withdrawal receipts, sign-ins. Nothing is pushed to you.

Source: trade/server/deposits.ts (notify), trade/server/web.ts (inbox)

## If you lose your way in

**There's no recovery.** The notice says so: "Your sign-in (your email, passkey or wallet) is the only way into this account." Export your key while you can.

A browser still signed in keeps working until its session ends. It can trade and withdraw to your saved address, but can't change that address or export the key. So save a withdrawal address early.

Source: trade/server/users.ts (WEB_TERMS), trade/server/web.ts

## If someone gets your way in

Whoever controls your email inbox, passkey or sign-in wallet can sign in as you. With no untie delay, they can change your saved address, withdraw and export your key at once. With a delay, those wait, and you can cancel from a signed-in browser until they go through. Use the time to get your money out.

Source: trade/server/withdraw.ts, trade/server/export.ts, trade/server/knots.ts