Accounts
An account connects a person or program to the credentials mesgd uses to establish identity. It holds a username, an authenticator, recovery codes, and either a password or a linked provider identity, with up to eight sessions and two public keys. Email is contact information rather than proof of ownership: mesgd does not verify the address or send mail.
Usernames are case-sensitive, up to 128 bytes, and may contain letters, digits, _, @, ., and -. Passwords are 12 to 1024 bytes. An authenticator code is six digits, sent as a string so a leading zero stays a zero.
Creating an account
| You want | What you do |
|---|---|
| The person chooses their own password | POST /auth/signup, then POST /auth/signup/confirm. The account cannot log in until confirm |
| You are on the node and you want an active account now | mesgd user add EMAIL. mesgd generates the password, confirms the authenticator, and writes the secret files |
| The person already has Google or GitHub | Start OAuth, then confirm an authenticator. That creates the account and the provider link |
| You are reserving a name for someone else | POST /auth/admin/create. You get a handoff code. They choose a password and enroll their own authenticator |
| You are replacing an account, including one you removed | mesgd user hard-reset USER on the node |
Public signup cannot take the configured administrator name, a service key identity, or a name that user remove has retired.
Account operations
- Enrollment and login for signup, login, password change, and a forgotten password
- OAuth for Google and GitHub
- Recovery for a lost authenticator
- Administration for operating other people's accounts
- HTTP API for the request and response fields
- Command line for
mesgd user
The browser UI is /account on the mesgd HTTPS origin. The current session token stays in sessionStorage for that tab. mesgd does not send other session tokens back to the page.