Docs

Your account

You sign in to CrabTalk with Google or GitHub, and a handle you pick names your account in URLs.

Signing in

  • Sign in with Google or GitHub. Your account's email is the one the provider gives, GitHub's primary verified email.
  • An email that already has an account signs in only with the provider it was made with. The refusal names that provider. Accounts are never merged.
  • Settings → Security lists your sign-in methods and active sessions. You can connect Google or GitHub, disconnect a provider while keeping at least one, and revoke any session but the current one. A session ends after 7 days unused.

Your handle

  • You pick a handle at your first sign-in. It names your account in URLs, as alice in crabtalk.ai/alice/notes.
  • Self-service handles are 5 to 20 lowercase letters, digits and hyphens and do not start or end with a hyphen. Existing and admin-assigned handles can fall outside those length bounds; no handle can be 32 hexadecimal characters.
  • Handles are saved in lowercase. Claims, admin assignments and account lookups accept mixed-case ASCII input: Alice and ALICE both name alice. Display names retain their capitalization.
  • People and orgs share one set of handles, subject to our handle policy.
  • You can change it under Settings → Profile. The old handle is free for anyone at once, and URLs with it stop working.
  • Every route that takes a handle also takes the account's id.

Account profiles and IDs

An ID stays with an account when its handle changes. With a session, GET /user returns your ID as user.id and your organizations under orgs.

GET /users/{user} and GET /orgs/{org} accept a handle or account ID and return the named account's ID as id. These profile lookups require a session; API keys receive 403. Organization profiles include private fields only for members. See Permissions.

Profile pages send signed-out visitors to sign-in. Public service listings and documentation remain readable without signing in.

GET /avatars/{owner} accepts a handle or account ID and redirects to the current avatar without sign-in. It returns 404 when the account has no avatar. Services display their configured logo, falling back to their owner's avatar and then initial.