Who can sign in · OC Me — OrangeCheck docs

view source

Every orangecheck account signs in to your app by default, however it was made: email, Google, GitHub or a Bitcoin wallet. To keep bots out, you can let in only accounts backed by bitcoin. The person has pledged one coin they hold (bonds). It never moves, and you never see it: your token carries only floors and a per-site nullifier.

1. Set the floor

Open your project on ochk.app or me.ochk.io. Under Choose how people sign in → Who can sign in, pick a minimum amount and age, for example 100,000 sats held 30 days. It's saved in the project and served, uncached, at GET https://me.ochk.io/api/integrator/<project_key>/sign-in.

2. Enforce it on your server

import { withOcAuth } from '@orangecheck/me-client/server';

export default withOcAuth(handler, {
    audience: 'https://your-site.example',
    projectKey: 'pk_live_yourapp',
});

A change in your settings is enforced within a minute. An account below the floor gets:

403 { "ok": false, "reason": "bond_required",
      "need": { "minSats": 100000, "minDays": 30 },
      "have": { "sats_floor": 10000, "days_floor": 90 } }

Send that person to ochk.app to back their account. If your requirement has never been readable, the request gets 503 bond_policy_unavailable rather than being let through unchecked.

Prefer code? requireBond: { minSats, minDays, maxAgeSecs } does the same and wins over projectKey. readBondClaim(session) and bondMeets(session, need) come from @orangecheck/me-client/server (or @orangecheck/auth-core) for your own checks: a fast lane, a higher free tier, a ban list keyed by oc_bond.nullifier.

Requires @orangecheck/me-client ≥ 0.27.3.