Your account
You sign in to CrabTalk with Google or GitHub, and a handle you pick names your account in URLs.
Signing in
- Sign in with Google or GitHub. Your account's email is the one the provider gives, GitHub's primary verified email.
- An email that already has an account signs in only with the provider it was made with. The refusal names that provider. Accounts are never merged.
- Settings → Security lists your sign-in methods and active sessions. You can connect Google or GitHub, disconnect a provider while keeping at least one, and revoke any session but the current one. A session ends after 7 days unused.
Your handle
- You pick a handle at your first sign-in. It names your account in URLs, as
aliceincrabtalk.ai/alice/notes. - Self-service handles are 5 to 20 lowercase letters, digits and hyphens and do not start or end with a hyphen. Existing and admin-assigned handles can fall outside those length bounds; no handle can be 32 hexadecimal characters.
- Handles are saved in lowercase. Claims, admin assignments and account lookups accept mixed-case ASCII input:
AliceandALICEboth namealice. Display names retain their capitalization. - People and orgs share one set of handles, subject to our handle policy.
- You can change it under Settings → Profile. The old handle is free for anyone at once, and URLs with it stop working.
- Every route that takes a handle also takes the account's id.
Account profiles and IDs
An ID stays with an account when its handle changes. With a session, GET /user returns your ID as user.id and your organizations under orgs.
GET /users/{user} and GET /orgs/{org} accept a handle or account ID and return the named account's ID as id. These profile lookups require a session; API keys receive 403. Organization profiles include private fields only for members. See Permissions.
Profile pages send signed-out visitors to sign-in. Public service listings and documentation remain readable without signing in.
GET /avatars/{owner} accepts a handle or account ID and redirects to the current avatar without sign-in. It returns 404 when the account has no avatar. Services display their configured logo, falling back to their owner's avatar and then initial.