Introducing auth v2, what keeps your diamonds safe

Auth v2 is live: passkeys, Discord login, session control, and a full account dashboard — built on a foundation designed to last.

To most of the world, "mined 1,000 obsidian" is not exactly sensitive information. To you, it's hours of grinding — diamond pickaxe, ten seconds a block, no shortcuts. And to us, it's exactly as sacred as it is to you. Your badges, your quests, your stats, your account: that's what we're entrusted with, and that's what we protect.

So we spent this cycle doing something unglamorous: rebuilding the entire account system from the bedrock up. No new quests today, no shiny badge. Instead, foundations first — because everything we want to build next (and there's a lot) sits on top of this.

Here's what changed.

TL;DR — Passkeys (Face ID / fingerprint) are here and recommended · Passwords now optional, with saner rules · One-click Discord sign-in · See and revoke every active session · Security emails with a "Wasn't you?" escape hatch on every change · Full data export and self-service deletion · Your date of birth is invisible to everyone, including us · Existing accounts: nothing to do — everything carried over.

More ways to sign in, all of them stronger

Passkeys are here, and they're the way we recommend you sign in. Face ID, fingerprint, or your device PIN — no password to remember, no password to steal. Passkeys are phishing-resistant by design: there's no shared secret that a fake login page can trick out of you. Add one per device, manage them all in settings.

Passwords are now optional. If you keep one, the rules got saner: minimum 8 characters, checked against known breach databases, and no more forced P@ssw0rd! gymnastics — symbol requirements don't actually make passwords stronger, so we dropped them. You'll always keep at least one way to sign in; the system won't let you remove your last method and lock yourself out.

Sign in with Discord. One click and you're in. Link or unlink anytime in settings — one Discord per Blocktopia account, so nobody can hijack your identity with a duplicate link.

And if you ever do get locked out: forgot-password and email-code recovery flows will get you back in.

You can see everything. You can revoke anything.

The new My Account area at account.blocktopia.world puts you in control:

• Sessions & devices — see every active session with device, IP, and last-active time. Spot something that isn't you? Revoke it individually, or sign out everywhere with one click.
• Step-up re-authentication — sensitive actions (changing your password, adding a passkey, linking Discord, exporting data, deleting your account) require you to re-authenticate on the spot. Someone with access to your already-logged-in screen can't quietly take over your account.
• Lockout protection — too many failed sign-in attempts locks the account for 15 minutes, recoverable via email code. Brute force doesn't work here.

Emails that actually protect you

Every meaningful account change now triggers a security notification: password changed, passkey added or removed, Discord linked or unlinked, signed out everywhere, account locked — the lot.

Two details we're particularly proud of:

Every notice has a "Wasn't you?" path. One click takes you straight to resetting your password, signing out everywhere, and reviewing your sign-in methods. Early warning plus an immediate response — that's how takeovers get stopped.

Email changes can't happen silently. Your old address gets notified both when a change is requested and when it completes — and it stays your login until the new address is confirmed with a 6-digit code. An attacker can't swap your email out from under you.

And yes — every one of these emails explicitly confirms it: your badges, quests, and stats are never touched. Nothing resets.

Your data, your call

This isn't a compliance checkbox for us. If Blocktopia holds anything about you, you should be able to see it, take it with you, or wipe it — without asking anyone's permission.

• Export everything, anytime. Download the full picture of what we hold — profile, consent records, date of birth — self-service, no support ticket, no waiting.
• Delete your account yourself. Schedule it whenever you want, with a grace period built in. Changed your mind? Sign back in before the deletion date and it's cancelled. Your account, your decision, reversible until it isn't.
• Choose what lands in your inbox. A toggle for product and community updates is now available in your account settings. Your inbox, your rules.

And then there's your date of birth. Honestly? We don't want it. But keeping Blocktopia a safe platform means verifying everyone is 16 or older, so we need to ask once. Here's the deal we made with ourselves about it: your date of birth is never exposed to the frontend. It doesn't appear on your profile, it's never returned anywhere in the product, and nobody can look it up — not even admins. All anyone on our side ever sees is a single flag: adult or not. The only place your actual birth date exists for human eyes is your own data export.

What do I need to do?

Nothing. Your login, password, and linked Minecraft account all carried over. No forced password reset, no re-linking, no migration steps. Sign in as usual — everything just got safer around you.

(Though if you want our advice: go add a passkey. It takes thirty seconds and it's the single best upgrade you can give your account.)

Foundations first

None of this is flashy. But this rebuild lays the groundwork for "Sign in with Blocktopia" — a single sign-on that will follow you across every Blocktopia property we launch. One identity, one set of security guarantees, everywhere.

You earned every one of those blocks the slow way. We built this the same way — slow, careful, no shortcuts — so that everything sitting on top of it holds. Your grind is safe with us.

See you on the server — and check out your new account dashboard at account.blocktopia.world.