Accounts & Access

An instance is invite-only by default. This page covers the three pieces that decide who gets in and what they can see: authentication, invitation codes, and organizations.

Authentication

Accounts are backed by Better Auth, giving every player a secure login and every organizer confidence that tournament data is tied to a real, authenticated identity.

Two authentication methods are supported, independently togglable per deployment:

• Native email & password — built in, no extra setup.
• Keycloak SSO — OIDC-based single sign-on through Keycloak, with optional PKCE.

Both can be enabled at the same time: players choose either method on the same login screen. A Keycloak account automatically links to an existing native account that shares the same email, so nobody ends up with duplicate accounts.

The variables that switch these on are listed in Environment Variables.

Invitation codes

There is no open sign-up. Every account starts from an invitation code issued by the instance administrator — a four-word passphrase like frost-otter-ridge-plume, easy to read out loud or drop in a message.

Each code carries its own rules:

• A number of uses — one by default, or a larger batch for a whole team.
• An optional expiry — a code can run out after a set number of days, or never expire.
• An optional organization — bind a code to a group and redeeming it also makes the new player a member, so onboarding a private league is a single link.

There are three ways a code gets used:

• At sign-up — enter it on the registration screen, or follow a prefilled invite link that fills it in for you.
• After signing in — if an account was created without a code, the app asks for one before letting it in, rather than leaving a half-open account.
• To join another group later — an established player can redeem an organization-bound code from their settings to join an extra organization, without touching their account.

The gate applies to every login method: Keycloak SSO doesn’t bypass it. Signing in through your identity provider still leaves you on the code screen until a code is redeemed, so an open SSO realm can’t quietly become an open instance.

Organizations

By default a tournament is public on the instance: anyone can browse it, follow the standings, and read the match history — signed in or not. That’s the right default for a community ladder, and the wrong one for a company league or a private club.

Attaching an organization to a tournament makes it visible only to that organization’s members:

• It disappears from the listing for everyone else — non-members simply never see it.
• The tournament itself is closed too, not just hidden. Standings, matches, and entries are all refused to non-members, so a shared link leaks nothing.
• Members keep everything else. Belonging to an organization doesn’t hide the public tournaments — you see the public ones plus your group’s.

A player can belong to several organizations at once, which is what makes one instance workable for a company, its teams, and an open community side by side.

Organizations are created and their membership is managed by the instance administrator, who also picks the organization when creating a tournament — leaving it empty keeps the tournament public.