Skip to main content
Authentication Flow
/cloudsyncfor gist-backed backup sync/bundles/submitfor custom content submissions/quests/submitfor quest-focused submission flows- Quest options explicitly gated by
requiresGitHub - Scope:
gist(read/write) - Classic PAT:
repo(and optionallygistif reused for cloud sync) - Fine-grained PAT: repository content + pull request permissions for
democratizedspace/dspace - Credentials are stored in IndexedDB so players do not need to re-enter tokens every session.
- Token values are persisted under game-state credential keys (for example
gameState.github.token). - Settings provides Clear and Log out controls that remove saved credentials from the device.
- Use separate tokens for sync and submissions when possible.
- Revoke tokens in GitHub settings if a device is compromised.
- Clear credentials after using shared machines.
- Never paste tokens into quest text, docs markdown, or issue comments.
Authentication Flow
Most of DSPACE works offline and unauthenticated. Authentication is only required for GitHub-integrated features.
