Accounts and sign-in

Sign-in on Zoov.dev always goes through Discord. The button reads "Login with Discord" in most places and "Continue with Discord" on the /login page. Clicking it opens /auth/start, which sends you to Discord's authorize screen and back.

Two transports exist, picked automatically:

• Popup (desktop browsers). A 500 by 880 pixel window named "zoov-discord-auth" opens on Discord. When it finishes, the page you were on refreshes its session in place, so editor state survives. If the browser blocks the popup, the site falls back to a full-page redirect immediately.
• Redirect (phones, tablets, in-app browsers). The whole tab navigates to Discord and comes back. This is used for any mobile user agent, for iPads, for touch devices narrower than 900 pixels, and for embedded browsers inside Discord, Instagram, TikTok, Facebook, Twitter, Snapchat, Pinterest, LinkedIn and Android WebViews, because popups do not work reliably there.

The /login page wears the workspace design since 2026-09-19 (it is one address for the old site and the workspace alike, so it moved to the shared (pages) group; the behaviour below did not change, only how it is drawn: a large "Sign in" title, the line "Opening Discord" while it leaves, and the button Continue with Discord). Visiting /login directly starts Discord automatically once. If you land on /login again within two minutes, it shows the "Continue with Discord" button instead of bouncing you back to Discord, so a failing flow never loops. Protected pages send you to /login?redirect=<page> and you return there after signing in. Only local paths are honoured as a return destination.

Discord asks for these scopes: identify, email, guilds.join and role_connections.write. There is no /signup page; the same Discord flow creates the account on first sign-in.

After Discord approves, the site exchanges the code for a session and then runs a set of best-effort steps. None of them can fail your sign-in:

1. Your profile row is updated with your Discord id, display name, avatar and email.
2. Your credits row is created if it does not exist.
3. You are added to the Zoov.dev Discord server automatically using the guilds.join permission you granted.
4. If you arrived through a referral link (the zoov_ref cookie) and the account is new (the auth user under an hour old), the referral is recorded and the cookie removed; an existing account only loses the cookie. The device and address of every sign-in are also put on the account's record for the referral program's same-browser check. See the referrals doc (2026-10-01).
5. The site checks whether you are a member of the Zoov.dev Discord server.

You then land on the page you started from. If the site could not determine membership (Discord outage, rate limit), you are let through anyway; only a definite "not a member" answer sends you to /discord.

Zoov.dev requires membership of the Zoov.dev Discord server. Auto-join at sign-in normally handles this, but if Discord reports you are not a member you are sent to /discord, which says "Please join the discord for access." with a "Join the discord" button (opens https://discord.zoov.dev), an "Already joined?" divider, a "Continue" button that returns you to where you were, and "Go Back".

If you left the server, join again through that page and press "Continue". Roles and paid tiers are also read from this server, so leaving it removes access to paid tools until you rejoin. Roles are re-synced from Discord at most every 15 minutes.

One thing no longer depends on being in the server (2026-09-20): the Photoshop and Photopea plugin. An active Plugin Pass, Standard, Pro or Max subscription opens it from the subscription itself, so a subscriber who left the Discord, or whose role has not arrived, is not refused. Sign-in is unchanged, and so is everything else that reads a Discord role. The same day the front page became the workspace landing (/ serves what was /discover); sign-in links and the next= return path are unaffected.

Every failed sign-in ends on /login?error=<code> (or the same code inside the popup result). The page shows a title and message, a "Try again" button, and for some codes a second button, "Reset sign-in cookies" (it read "Still stuck? Reset sign-in cookies and retry." before 2026-09-19).

The old /auth/error page redirects to /login?error=unknown.

The "Reset sign-in cookies" link goes to /auth/reset. It deletes every Supabase auth cookie (names starting with sb-), including stale partitioned copies that some browsers keep in a separate jar and that break the Discord callback. You are then returned to /login to try again. Use this when a user reports being bounced to the homepage signed out, or repeated state, exchange or unknown errors. It signs you out of Zoov.dev in that browser but does nothing to your Discord account.

Cancelled on Discord. Code denied. Just try again.

Discord app or in-app browser. The flow started inside the Discord, Instagram or TikTok app and finished in the system browser, so the cookie that started it is missing. The site retries once automatically with a silent Discord prompt; if that also fails you get exchange. Fix: open zoov.dev in Safari or Chrome directly and sign in there.

Opened the callback twice. Link previews, or the Discord app plus a browser both opening the return link, produce state. If a session already exists from the first hit the site treats the second as success, so usually the user is already signed in and only needs to reload.

Popup closed with no result. The site does not assume failure. It re-reads the session first; only if there is still no user does it report closed.

Stuck signed out after every attempt. Use "Reset sign-in cookies" (/auth/reset), then sign in again.

Every /app page is drawn for a visitor, but under a card: the tool's name, Sign in with Discord (back to the same tool and project once Discord approves), "Free account · 50 credits to start · every tool" and See plans. Nothing in a tool can be pressed before signing in; the top bar's own Sign in does the same. Why: every conversion, generation and count already needed an account (the conversion box checks the session on every call), so what a visitor could do without one was exactly what could not be counted, and visitors never met a limit or a plan. The plugin panels inside Photoshop and Photopea keep their own sign-in (the link code); the competition pages and the plugin page are outside the workspace and open as before. Someone who says "the workspace is greyed out" or "I can only see a sign-in card" is not signed in; the card's button is the way in. Internal: src/lib/workspace/shell/SignInVeil.svelte, mounted by src/routes/(app)/+layout.svelte when the layout's load found no user; the analytics door is veil. Since 2026-09-30 the tool behind the card is darkened, not blurred (bg-veil, near-black at 82%, the plugin panel's sign-in card made darker): the tool stays faintly visible and sharp, and nothing in it competes with the card. On 2026-09-29 it had been blurred and greyed (the dialogs' bg-overlay, a 16px blur), which the owner found foggy; before that it was only lightly tinted, so the tool's own drop card, its purple button and its words showed through around the sign-in card and the two read as one confusing screen.

Being signed in does not reload the page when you come back to the tab (2026-09-29). The browser session announces itself again every time a tab is looked at, and the site used to treat that as a fresh sign-in: every open zoov.dev tab reloaded its account data, and a link pressed at that moment could be dropped with the loading bar stuck (see "The bar across the top while a page loads" in workspace.md). The data now reloads only when the person actually changes: a sign-in, a sign-out, or a different account.

Sign out from the user menu, or open /auth/logout, which ends the session and sends you to the homepage /. The user menu signs out in place without a full page reload, so an open editor keeps its state and simply switches to the signed-out view. Sign-out only affects the current browser; other devices stay signed in until their own session ends. Signing out does not disconnect anything on Discord and does not remove you from the Discord server. If sign-out appears not to stick (you are still shown as signed in after a reload), use /auth/reset, which force-deletes every auth cookie and lands you on /login.

Deleting your Zoov.dev account is done from /app/profile. Under the Marketing emails switch and the Plans, Billing and Sign out buttons there is a red area, Delete account, with the line "Files, credits, plan and keys · cannot be undone" and a Delete account button. The button opens the dialog "Delete your account?", which says "Removes your files, credits, plan and API keys for good. Payment records stay for accounting.", shows your Storage, Credits and Plan, adds "The plan is cancelled now. Nothing is refunded." when you are on a paid plan, and asks you to turn on the switch Yes, delete everything before the red Delete account button works. It is immediate. When it is done you are signed out and land on /goodbye ("Account deleted").

What goes: the sign-in, the profile, every file in the workspace and the tools (uploads, results, folders, the packs you own, including packs you shared with others), credits (permanent and plan credits alike), API keys and webhooks, the GitHub connection, team membership, referral links and rewards, notifications and preferences. An active plan or booster is cancelled at Stripe the same minute, with no refund and no final invoice, and the saved card goes with the Stripe customer. Paid Discord roles are removed where the bot can. There is no grace period and nothing can be restored.

What stays: payment records (Stripe charges and invoices, and the local payment rows with the account removed, kept for accounting), the system log with the account removed, and one small record of the deletion: the Discord id, the email, the date, a few counts and, since 2026-10-07, the browsers the account signed in from (a hash of the browser's id, nothing readable). That record is what the privacy policy's fraud-prevention clause allows, and it stops a deleted account from being paid out as a referral or given the 50-credit sign-up bonus again when the same person signs up afresh — on the same Discord account, the same email, or in the same browser. Support data in Discord (tickets, transcripts) is separate: /optout delete-my-data in the Discord server removes that.

Team owners cannot delete while their team is live. The dialog's button then fails with "Could not delete · cancel the team plan first": cancel the team plan from Billing on /app/team (members lose their team benefits through the normal cancellation), then delete. Team members can delete at any time; their seat frees.

Anyone can sign up again afterwards with the same Discord account. The new account starts empty, without the sign-up bonus, and is nobody's referral. A new Discord account or a new email does not change that when it is made in the same browser: the sign-up bonus is also withheld from a brand-new account in a browser that already holds one, or that held one that was deleted. Staff can add the 50 credits by hand when the browser is genuinely shared — a family computer, a school, a friend's laptop — and #watchdog gets a line for every account it happens to, so ask there.

The Photoshop plugin signs in through /link. The plugin shows a six-character code; the page "Approve Plugin Link" either receives it in the URL (/link?code=ABC123) or asks you to type it into "Plugin code". It never approves by itself (since 2026-09-15; before that a code in the URL was approved the moment the page loaded, so anyone who made a code and sent you the link could sign in as you). With a code in the URL the page shows what asked for it: Plugin (Photoshop, Photopea or Browser plugin, with its version), System, Requested (how long ago) and Network (the address the code was made from), then the warning "Approve only a code your own plugin is showing right now. Whoever made the code signs in as you once it is approved." and Approve Link. You must be signed in to Zoov.dev first; the page shows "Signed in as ". Errors you may see: "That link code was not found or has expired.", "That code was already used." and "Enter the 6-character code from the plugin." After "Approved. Return to the plugin." the tab closes itself after three seconds. Codes last 10 minutes and the page shows "Expires in Ns". An approved code the plugin has not collected within two minutes of expiring is thrown away and its plugin session signed out. One network can create at most 10 codes in 10 minutes; past that the plugin shows "Too many sign-in codes from this network. Wait a few minutes and try again."

A plugin session that ends while the panel is open (for example after an hour with no renewal) now brings the panel's sign-in card back instead of leaving "Sign in again" with no way in, and the panel keeps Photoshop's saved session up to date so reopening it signs back in (2026-09-23; see the Photoshop plugin doc).

Approving a plugin sign-in could fail with a red Signed out line on a page that was, at the same moment, drawing the person's name and avatar. Pressing Approve did nothing else, and there was nothing on the page to press to fix it; signing out and back in was the only way through.

The page and the route that approves disagreed about what being signed in meant. The page verified the session's token by itself, as every page here does. The approve route asked the auth server outright — a stricter question, and one that fails for reasons that have nothing to do with the person: an access token past its hour, or a refresh token the browser's own client had already rotated. So the page drew the account and its only button refused.

The approve route now accepts the same verified token as the rest of the site, refreshed if it has aged. Making the page ask the strict question instead was tried first and was worse: a second refresh from the server rotated the token out from under the browser, and people were sent to sign in moments after signing in. If the session has genuinely gone, approving sends them to Discord and back to the same code rather than leaving the message on screen.

A tool says "Sign in to …". Where do I sign in? Press the Sign in button on that message (toasts, failed tasks in the tray and error lines all carry one since 2026-09-22). It goes through Discord and brings you back to the page you were on. The profile menu in the top bar still has Sign in too.

I made a new account and the Free limits are already used. Why? Free's daily limits are one per browser since 2026-10-09: every account that signs in from the same browser shares one Free day (the Designer's minutes, exports and previews, the one UV map, vehicle, mod, ped and shell, and the 5 conversions or optimizations). A second account on the same computer shares the first one's day, as it shares the rule that withholds the 50-credit sign-up bonus from a second account in a browser. Work done on a paid plan never counts toward it. The day comes back at the usual time (midnight UTC, or 24 hours after a file for conversions and optimizing); any plan from Standard up removes the limits. See workspace.md, "One Free day per browser".

Can I sign in with email and password? No. Discord is the only sign-in method. There is no password to reset.

Do I have to join the Discord server? Yes. Sign-in joins you automatically. If you leave, /discord asks you to rejoin before continuing.

I keep getting sent back to Discord or to the homepage. Open /login, use "Try again", and if it repeats click "Reset sign-in cookies". Then sign in from a normal browser, not from inside the Discord app.

Sign-in works on my PC but not on my phone. Phones use a full-page redirect. Open zoov.dev in Safari or Chrome rather than an in-app browser, and finish the Discord screen in the same tab.

I changed my Discord name or avatar. Why does Zoov.dev still show the old one? Your profile is refreshed from Discord every time you sign in. Sign out and back in.

Can I link a second Discord account or merge accounts? Not documented, ask staff.

How do I delete my account? Open /app/profile, press Delete account at the bottom, turn on Yes, delete everything and press Delete account in the dialog. It is immediate and cannot be undone: files, credits, plan, keys and the sign-in are gone. Payment records are kept. A team owner must cancel the team plan first ("Could not delete · cancel the team plan first").

I deleted my account by mistake. Can it be restored? No. Nothing is kept but payment records. Signing in with Discord again makes a new, empty account, without the sign-up bonus.