Orbit2D has always saved in the browser you played it in. That is genuinely fine — no account, no
friction, close the tab and your colony is still there. It stops being fine the moment you clear your
browsing data, or open the game on your phone instead of the laptop, and discover that the colony you
spent a fortnight on lives somewhere you can’t reach.
So there is now an optional account. It is called a Colony Key, and it has no
password, because passwords are the worst part of every account system ever built.
The key is the credential
You press one button. The server mints something like
CK-CA9W4-GZXCW-896CC and shows it to you once. That string is your account:
no email required, nothing to choose, nothing to remember, nothing to type twice. The browser keeps it
for you, and you keep a copy somewhere if you care about the colony.
Nobody picks a Colony Key, which means nobody picks a bad one, and there is no reused password to
leak. The first five characters are a lookup handle; the next nine are the proof; the last one is a
checksum over the other fourteen, so a typo is rejected on the spot instead of being sent to the
server as a guess. The proof half is stored hashed — the same reason a password would be. That has a
consequence worth being blunt about: we cannot look your key up and send it to you.
If you give the game an email address, we can replace it. If you don’t, and you lose it, that colony
is gone. The panel says so, in those words, at the moment it matters.
Where this design came from
Not from scratch. There was an SSO service in the back catalogue — GameGrip Auth, Node and MySQL,
decommissioned last month — and the first instinct was to redeploy it. That was the wrong instinct:
orbit2d.co is flat-file PHP on shared hosting, and standing up a Node service and a database to hold
a save file would have been the single most fragile thing in the project.
What was worth taking was the thinking, and it ported cleanly:
- Sessions are revocable. A session token is random, stored only as a hash, and
listed against the account — so signing out actually ends the session server-side rather than politely
forgetting a self-contained blob. Eight devices at a time, six months each. - Nothing secret is stored in the clear — not the key, not the tokens.
- Rate limiting per address, per action, and an audit line on every change.
- A CORS whitelist with no wildcards — the site and the packaged Android app,
nothing else.
What it actually does for you
Signed in, each world uploads its save as you play and pulls it back on any device you sign into,
up to thirty slots. The panel lists what has synced, lets you name the colony, attach a recovery
address, sign out, or delete the whole thing — and delete means the account and every save,
permanently, in one click, no email confirmation loop.
The other thing it fixes quietly: the Deep Charter used to be bound to devices, with a limit on how
many. That was always a slightly grudging answer to a question nobody asked. A Charter code linked to
a Colony Key now belongs to the colony, so it works everywhere you sign in. Entitlement
follows the person, which is what everyone assumed it did in the first place.
And to be clear about the part that matters most: this is optional. Ignore the panel entirely and
Orbit2D behaves exactly as it always has, saving locally, asking you for nothing. The Charter promise
holds too — everything already in the game stays free.
Live at orbit2d.co.
Leave a Reply