exo[intel]/docs
Open app ↗
docsaccount-and-signup

EXOINTEL — Account, Signup & Auth

Source of truth: apps/web/src/app/api/auth/*, lib/auth/*, lib/email/*, live .env on the VPS (OPEN_SIGNUP=true, RESEND_API_KEY/EMAIL_FROM set). Compiled 2026-07-19.

Signup flow (self-serve, currently open)

Registration is self-serve (OPEN_SIGNUP=true on the live deployment) with email verification (transactional mail is configured via Resend):

  1. User signs up with email + password at exointel.watch.
  2. Password must pass the app’s minimum length check (see passwordLengthError in lib/auth/password.ts) — no other public complexity rule found.
  3. Account is created with status pending and a verification email is sent with a 24-hour link.
  4. Clicking the link activates the account (email_verified_at set); user can then log in normally.
  5. If the user tries to log in before verifying, the app auto-resends a fresh verification link (rate-limited so it can’t be abused for spam).
  6. Duplicate email signups always get the same generic success response (no account-enumeration leak) — if a customer says “it says account created but I never get emails,” it’s worth checking whether they already have an account under that address.

No credit card / payment info is required to sign up or to use the Free plan.

Login

  • Email + password. Login is rate-limited both per-IP and per-account.
  • 2FA (TOTP): optional, user-enabled from the account cabinet. If enabled, a correct password triggers a second step asking for a 6-digit authenticator code (or a one-time recovery code) before a session is created.
  • Account states: pending (awaiting email verification or, in closed-beta mode, admin approval — not applicable while OPEN_SIGNUP is on), active, disabled (support/admin action).

Password reset

  • “Forgot password” sends a reset link (1-hour TTL) to the account email.
  • Reset requests are rate-limited per IP and per account to prevent mail-bombing.

Account cabinet

From inside the app, a logged-in user can:

  • View current plan + this-month usage per meter (lookups/AI/scanner/recon/sweep/spider)
  • Upgrade/downgrade/cancel the subscription (opens Paddle’s customer portal)
  • Enable/disable 2FA (TOTP)
  • Manage active sessions

Support / escalation contact

  • General support & billing/refund requests: exocriador@gmail.com
  • Live chat/Telegram support inbox: Chatwoot at support.exointel.watch