Registration & Email Verification
To create an account on Devlio, visit /register and provide:
- Username: 3 to 20 characters (alphanumeric and underscores only).
- Email Address: A valid email for notifications, download links, and 2FA tokens.
- Password: Minimum 8 characters with high entropy requirements.
- Bot Protection: Cloudflare Turnstile verification ensures human registration.
Email Verification Code: Upon submitting the registration form, you will receive a 6-digit confirmation code valid for 10 minutes. Enter this code on the verification screen to unlock publishing and purchasing.
Login & Brute-Force Protection
Sign in at /login using your email and password. For security, Devlio implements active rate limiting:
- Failed Login Throttling: After 5 consecutive failed attempts from an IP address or account, the account enters a temporary lockout to prevent automated credential attacks.
- Remember Me Option: Selecting "Remember Me" keeps your session active for 30 days across browser restarts. Default session expires after 30 minutes of inactivity.
Two-Factor Authentication (2FA)
Devlio supports email-based 2FA to guarantee maximum account security for both creators and buyers.
Navigate to Security Settings
Open Profile → Security from your user dropdown menu.
Click "Enable Two-Factor Authentication"
The system will generate a verification code and send it directly to your registered email.
Verify Code & Receive Recovery Codes
Enter the 6-digit email code. Once confirmed, you will be presented with 10 Single-Use Emergency Recovery Codes.
Save Your Recovery Codes: If you ever lose access to your email account, each recovery code can be used exactly once to bypass 2FA and regain account control.
OAuth Single Sign-On (SSO)
Devlio integrates with leading OAuth providers for 1-click seamless authentication:
Discord Login
Link your Discord account to sync your avatar and receive instant sales notifications.
Google Sign-In
Authenticate with Google Workspace or Gmail. Automatically links to existing accounts with matching emails.
Active Session & Device Management
You can inspect all devices and browsers currently logged into your account in Profile → Security. The device table reveals:
| Information | Detail |
|---|---|
| Browser & OS | Chrome, Firefox, Safari, Edge, Android, iOS, Windows, macOS, Linux |
| IP Address | Masked client IP for audit protection |
| Last Active | Timestamp of most recent activity |
| Action | 1-Click "Revoke" button to remotely terminate suspicious sessions |