docsaccount-and-signup
EXOINTEL — Account, Signup & Auth
Source of truth: apps/web/src/app/api/auth/*, lib/auth/*, lib/email/*,
live .env on the VPS (OPEN_SIGNUP=true, RESEND_API_KEY/EMAIL_FROM set).
Compiled 2026-07-19.
Signup flow (self-serve, currently open)
Registration is self-serve (OPEN_SIGNUP=true on the live deployment) with
email verification (transactional mail is configured via Resend):
- User signs up with email + password at exointel.watch.
- Password must pass the app’s minimum length check (see
passwordLengthErrorinlib/auth/password.ts) — no other public complexity rule found. - Account is created with status
pendingand a verification email is sent with a 24-hour link. - Clicking the link activates the account (
email_verified_atset); user can then log in normally. - If the user tries to log in before verifying, the app auto-resends a fresh verification link (rate-limited so it can’t be abused for spam).
- Duplicate email signups always get the same generic success response (no account-enumeration leak) — if a customer says “it says account created but I never get emails,” it’s worth checking whether they already have an account under that address.
No credit card / payment info is required to sign up or to use the Free plan.
Login
- Email + password. Login is rate-limited both per-IP and per-account.
- 2FA (TOTP): optional, user-enabled from the account cabinet. If enabled, a correct password triggers a second step asking for a 6-digit authenticator code (or a one-time recovery code) before a session is created.
- Account states:
pending(awaiting email verification or, in closed-beta mode, admin approval — not applicable while OPEN_SIGNUP is on),active,disabled(support/admin action).
Password reset
- “Forgot password” sends a reset link (1-hour TTL) to the account email.
- Reset requests are rate-limited per IP and per account to prevent mail-bombing.
Account cabinet
From inside the app, a logged-in user can:
- View current plan + this-month usage per meter (lookups/AI/scanner/recon/sweep/spider)
- Upgrade/downgrade/cancel the subscription (opens Paddle’s customer portal)
- Enable/disable 2FA (TOTP)
- Manage active sessions
Support / escalation contact
- General support & billing/refund requests: exocriador@gmail.com
- Live chat/Telegram support inbox: Chatwoot at support.exointel.watch