Accounts and CLI authentication

Your creator account is shared by the website and the CLI. Sign in at creators.threetopia.com using an eight-digit email code. Codes expire after ten minutes and can be used once. There are five verification attempts per code, with delivery rate limits.

Your display name can change. Your handle cannot: it identifies your package namespace, for example @river-maker/water-lilies. Handles contain 3–30 lowercase letters, numbers and hyphens, beginning with a letter.

Your email is private. Your handle and display name are public when you publish a package or install one. Package owners can see which creators currently have their package installed through the CLI, including exact versions and number of installations. They cannot see your email, source code, or private project names.

Connect a terminal

threetopia login
threetopia whoami

The CLI uses browser approval. Compare the eight-character code in your terminal with the browser page before approving. Browser sessions last seven days; CLI tokens last 90 days.

Credentials are stored in ~/.config/threetopia/credentials.json with file permissions 0600. Tokens are keyed by registry origin. Set THREETOPIA_HOME to choose a different configuration directory.

threetopia logout

Logout revokes that terminal’s token. You can also revoke connected terminals under CLI & account in your studio. Signing out of the browser does not revoke other devices.

Development

A local registry accepts --registry http://127.0.0.1:55020. HTTP is accepted only on loopback hosts. Production uses HTTPS. Development sign-in codes are returned only when the server explicitly enables local auth and the request host is loopback; production never returns a code.