One account, three places
An Orcyx account is a single identity for the website, the account portal where billing and credits live, and the desktop app. You create it once and sign in to all three with it. The account portal is the only place that holds your plan, your invoices and your credit balance; the desktop app reads them, it does not own them.
Accounts open when Orcyx launches. Register for the founding cohort on the home page and you will be able to create one on day one.
Ways to sign in
- Email and password. Passwords are stored hashed with scrypt and are never recoverable — only resettable.
- Google. One button, no password to remember. The account is matched on the verified email address Google returns.
- Apple. Wired and switched on per deployment; the button appears only where the provider is actually configured, rather than failing after you press it.
Whichever you use, you end up in the same account. A password sign-in and a Google sign-in on the same address are the same person, not two.
Verification codes
A new account has to prove it controls the address. We send a six-digit code by email. It is valid for ten minutes. After five wrong attempts the address is locked for fifteen minutes, which is a rate limit rather than a problem with your account — wait it out and ask for a fresh code.
If the code never arrives, check spam first, then use the resend link on the verification page. If sending itself failed, that page says so; it will not sit there implying an email is on the way when the service refused to send one.
Signing the desktop app in
The desktop app never asks for your password. It opens your normal browser, you sign in there, and the browser hands a one-time code back to the app over a loopback address on your own machine. Nothing sensitive travels in a URL and no token is ever pasted between windows.
Before the hand-off you will see an interstitial naming the local port the code is about to be sent to. Only continue if you started that sign-in from the app on this machine. If you did not, close the page — that warning is the whole point of it.
If your browser cannot reach the loopback address, the app falls back to a custom link scheme. Both routes end in the same place.
Forgot your password
Use the forgot-password link on the sign-in page. You get a code by email, and the confirmation is the same whether or not the address has an account — nothing on that page reveals which, on purpose.
Resetting does not sign you in. Once the new password is set you type it once on the sign-in page, so a password nobody has successfully used yet cannot become the one on your account.
Staying signed in, and signing out
Your browser session lives in cookies the page itself cannot read. Signing out clears them immediately, whether or not the server acknowledges it: you asked to be signed out, so you are.
Lost a laptop, or think a session is not yours? Ask support to sign the account out everywhere. Every live session is revoked at once and each device goes back through normal sign-in.
When something goes wrong
- “An account with this email already exists” — sign in instead, or reset the password if you never set one.
- “Too many code attempts” — a fifteen-minute lock after five wrong codes. Request a new code once it lifts.
- “Your session could not be stored” — the sign-in worked but the browser refused the cookie. Check that cookies are allowed for the portal and try again.
- A sign-in that returns you to the sign-in page — the destination you were heading to was rejected as unsafe and dropped. Navigate to it again once signed in.
Anything else: the page tells you what the service actually said. Quote that line when you ask for help — it names the failure precisely.