How Sign in with Dash works

1. The website creates a short-lived, domain-bound login request and shows a QR (or link).
2. Your authenticator fetches the request over HTTPS, shows the domain and action, and asks you to approve.
3. You approve; the phone signs a canonical challenge with an eligible Dash identity authentication key (HIGH).
4. The website verifies the signature and checks Dash Platform (identity keys + DPNS name). On this demo in simulator mode, fixtures stand in for Platform.
5. Only the browser that started the login (binding cookie) can finish and receive a session cookie.

What it is not

• Not a password or email magic link
• Not Yappr-style key transfer into the website (this site never holds your keys)
• Not phishing-proof for QR forwarding in the MVP — only approve logins you started
• Not mainnet-ready

Account model on this demo

Accounts are identity-bound: the Dash identity ID is the stable key; the DPNS name is a public handle. Session cookies last for the browser session only.