Passkeys & arcade sessions

Create or recover your account#

PONGIT uses Mera and a passkey provider that supports WebAuthn PRF. Use the HTTPS site at pongit.xyz. No wallet extension is required.

• Create a passkey creates an account using a new credential.
• Continue as… uses the remembered account and credential.
• Use another passkey opens the provider's account selection.
• Forget this account removes the browser's remembered hint. It does not delete the passkey or onchain funds.

An unsupported provider produces a compatibility error. Use a PRF-compatible provider rather than repeatedly creating credentials. Recovering the same account requires the same passkey and working provider support; a username is not an account recovery method.

Your two-hour arcade session#

After connection, approve a limited gameplay authorization lasting up to two hours. It allows matchmaking, accepting challenges, match consent, paddle control and conceding your own match across the approved human arena family. The first use of a new family needs approval; subsequent arenas reuse an unexpired authorization.

The limited key and authorization are kept in sessionStorage, so F5 in the same tab can recover the session. The browser remembers the wallet address, credential identifier and domain separately. Wallet keys and decrypted notebook contents are not saved in those stores.

Only one tab may control a game for a given account and deployment. Keep the controlling tab open. Closing it ends its local session storage.

Renew without extra navigation#

When the rooms session expires, the header displays Renew session. Clicking it renews the session directly. Your matchmaking or invitation choice carries through renewal. A temporary game-node outage preserves the authorization and retries synchronization automatically, without opening a passkey prompt.

Spending still needs a separate owner passkey approval: bets, withdrawals, tournament registration and administration are not covered by the arcade grant.

Disconnect safely#

Open the account button and select Disconnect. The independent arcade attempts owner-approved revocation of future family admissions and the active arena, then removes the local key. If either network confirmation fails, it reports Disconnected locally. Network revocation remains to be confirmed. A pending revocation is not proof that another copy is unusable; the original expiry still applies. Legacy arenas retain their own revocation flows. Closing the account also locks decrypted private data.

Physical cross-device passkey recovery depends on your provider. Automated browser tests do not establish that every physical device/provider combination works. Permission details.